The bug stems from an integer overflow in the ceph_handle_auth_reply() routine of the Linux kernel’s libceph module. When a CEPH_MSG_AUTH_REPLY message carries a payload_len value larger than the maximum signed 32‑bit integer, the value is assigned to an int variable and overflows to a negative number. The negative value is then used to decrement a pointer, causing ceph_decode_need() to read memory beyond the bounds of the allocated buffer. The patch changes the data type of payload_len (and result_msg_len) to u32 and adds sanity checks to reject lengths that exceed the message segment, preventing the overflow and subsequent out‑of‑bounds read. The attack vector is not explicitly documented but is inferred from the description that a crafted CEPH_MSG_AUTH_REPLY message can trigger the overflow.

The flaw exists in any Linux kernel build that contains libceph before the upstream patch. All distributions that ship a kernel that predates the commit referenced in the CVE are potentially affected. The specific kernel versions are not enumerated in the CVE, so administrators should check whether their current kernel incorporates the patch or the commit identifiers cited in the provided references.

An attacker who can communicate with a node running the vulnerable libceph can send a crafted CEPH_MSG_AUTH_REPLY message to trigger the overflow. The precise attack vector is inferred from the description, as the vulnerability documentation does not provide explicit details. The result is a kernel memory read that may expose sensitive data. The CVSS score of 7.0 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog and has no EPSS score available, meaning the kernel memory read grants a high impact surface. The risk is therefore considered significant, and administrators should treat the patch as urgent.