In the Linux kernel the libceph module’s process_message_header() function may read data beyond the bounds of a message header when a message frame is corrupted or forged so that the declared control segment length is smaller than the header itself. This out-of-bounds read can expose kernel memory contents that are not intended to be visible, potentially leaking sensitive information.

All versions of the Linux kernel that include the libceph module and do not contain the commits that add an explicit bounds check before decoding the message header. The vulnerability remains until the kernel is updated to a release that incorporates these changes.

The CVSS score of 7.0 indicates a high severity level, and there is no EPSS score or KEV listing for this issue. Based on the description, it is inferred that an attacker could trigger the read by sending a crafted or truncated Ceph message frame to the kernel module, which suggests a remote network-based attack vector if Ceph traffic is exposed to untrusted hosts. No publicly known exploitation has been reported as of this analysis.