In the Linux kernel’s libceph module, a slab-out-of-bounds access can be triggered when a CEPH_MSG_AUTH_REPLY contains a positive result value. The kernel mistakenly treats that value as the size of the front segment for a subsequent CEPH_MSG_AUTH message and copies data beyond the allocated buffer, thereby leaking kernel memory contents to the network. This flaw is related to the weakness CWE-131 (Incorrect Calculation or Use of Buffer Size). The patch adds logic to treat only negative result values as errors and includes a BUG_ON that guards against sending a message whose calculated size exceeds the buffer. Based on the description, it is inferred that an attacker can inject a malicious CEPH_MSG_AUTH_REPLY along the Ceph data path to craft the out-of-bounds read and potentially trigger a kernel panic via the BUG_ON.

All Linux kernel builds that include the libceph module and that have not yet incorporated the commit implementing this out-of-bounds protection are affected. The vulnerability applies to every kernel version prior to the patch, regardless of kernel configuration, as long as libceph is compiled into the kernel.

The CVSS score of 9.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the weakness enables kernel memory disclosure and could lead to a denial‑of‑service via a BUG_ON panic. The most likely attack vector is a malicious Ceph client or monitor that can inject a crafted CEPH_MSG_AUTH_REPLY message; the attacker only needs to provoke the kernel to process the message. No public exploits have been documented, but the nature of the flaw makes future exploitation possible if a trusted Ceph component is compromised.