The vulnerability is triggered when a CEPH_MSG_OSD_MAP containing a crush map with mismatched bucket algorithm fields is processed by the kernel. The first algorithm field determines the allocation size for a bucket, while the second field is used during later processing. If these fields differ, an out-of-bounds memory access occurs, leading to possible kernel memory corruption or system crash.

All Linux kernel builds that include libceph support and lack the crash_decode patch are affected. This includes any distribution running a kernel prior to the inclusion of the fix that was introduced by the patch referenced in the CVE.

The flaw requires an attacker to inject a crafted CEPH_MSG_OSD_MAP into the kernel’s processing path, which is likely achievable over the network to a Ceph OSD node. No public exploit has been reported and the EPSS score is unavailable, but the kernel memory corruption nature of the defect warrants a high security importance. The vulnerability is not listed in the CISA KEV catalog, so documented exploitation is currently unknown.