The vulnerability exists in the Linux kernel’s Ceph decryption routine __ceph_x_decrypt(). While decrypting a message, the routine interprets part of the buffer as a ceph_x_encrypt_header and reads its magic field without verifying that the buffer is large enough to contain this header. If the ciphertext length is shorter than the size of the header, the function performs an out-of-bounds memory read. Such a read can expose kernel memory contents or, if the read value is subsequently used in kernel logic, could lead to a kernel panic or denial of service. No evidence in the description indicates privilege escalation.

All Linux kernel builds that include the libceph module are impacted. The patch was applied to the stable tree, indicating that recent kernel releases incorporate the fix. Systems that run a Linux kernel capable of communicating with Ceph clusters and therefore load libceph are potentially affected. No specific affected version information was provided by the vendor.

No CVSS score or EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog. Consequently, the exploitation likelihood is unquantified. The flaw resides in kernel code, so a successful exploit would require an attacker capable of injecting crafted Ceph messages that trigger the out-of-bounds read. No public exploit has been reported, suggesting the threat is theoretical at present.