A boundary check bug in the Linux kernel’s libceph osdmap_decode function can allow an attacker to read past the allocated buffer when decoding osd_state and osd_weight. The flaw arises because the ceph_decode_need() check only verifies the first element of the osd_weight array instead of accounting for the total number of OSD entries. If the incoming ceph message reports a max_osd value larger than the actual data, the code may read or write outside the bounds defined for osd_weight, corrupting kernel memory or leaking information. This could be leveraged to gain unprivileged kernel code execution or cause a system crash, depending on the attacker’s capability to craft messages and the kernel’s memory layout.

All Linux kernel installations that include the libceph module are potentially vulnerable until a patch that corrects the ceph_decode_need() check is applied. No specific version range is listed, so any older kernel that has not yet integrated the fix should be considered at risk.

The vulnerability is a classic out‑of‑bounds memory access, a serious kernel flaw that could be exploited by a remote or local attacker capable of sending malformed OSD maps to the kernel. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw allows overwrite or leakage of kernel data, it is likely that exploitation would require additional privilege or network access to Ceph messaging. Given its nature, the risk to systems that receive Ceph traffic is significant.