A flaw in the libceph module of the Linux kernel allows a malicious or corrupted message frame to cause the process_message_header() routine to read beyond the end of a valid message header. This out‑of‑bounds read can expose contents of kernel memory that are not intended to be visible, potentially leading to information disclosure. The defect was fixed by inserting an explicit bounds check before decoding the header.

Linux kernel releases that include the libceph module and have not incorporated the bounds‑check patch. In particular, development releases such as 7.0:rc1, 7.0:rc2, and 7.0:rc3 are affected if still in use. Systems running older stable kernels that lack this fix remain vulnerable until they are updated.

The CVSS score of 9.1 marks this vulnerability as critical. The EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that an attacker would need to send a crafted message frame to a system with an active libceph module, most likely over network traffic to a Ceph service. Successful exploitation would allow an attacker to read kernel memory, but no confirmed remote or local exploitation cases are documented in the provided data.