A flaw in the Linux kernel's libceph module allows an out-of-bounds read during authentication message processing. When a CEPH_MSG_AUTH_REPLY contains a positive result value, the kernel misinterprets it as an error code and later treats it as the size of the front segment when sending a CEPH_MSG_AUTH message. If that value exceeds the allocated buffer, the implementation copies beyond the memory boundary, sending uninitialized or sensitive kernel data. The same path introduces a BUG_ON that can trigger a kernel panic, potentially causing a denial of service.

All Linux kernel builds that include the libceph module are impacted. The issue is present in every kernel version prior to the commit that fixed the slab-out-of-bounds access; no specific upstream version numbers are delineated in the provided data.

The CVSS score is not listed, but the vulnerability enables kernel memory disclosure and can lead to a crash, representing a severe security risk. The EPSS metric is not available, so the likelihood of active exploitation remains undetermined. Because the bug resides in core kernel code, any host running a Ceph client or monitor is potentially exposed. The most likely attack vector is a Ceph node or client that can inject a malformed CEPH_MSG_AUTH_REPLY; the attacker need only provoke the kernel to process the crafted message. No CISA KEV listing exists, indicating no known public exploits, though the nature of the flaw suggests that future exploitation could become possible if an attacker can reliably deliver crafted authentication replies.