The vulnerability resides in libceph’s decode_lockers() function where two unguarded decode calls allow a malicious or compromised Ceph OSD to transmit crafted data that causes the kernel to read beyond the end of a validated buffer. This results in the kernel exposing 4 or 1 bytes of memory that can be interpreted as the number of lockers and the lock type field, respectively. The exposed memory may reveal information about kernel structures, and the attacker can inject arbitrary values into the lock type field, potentially affecting lock semantics. The flaw is an out-of-bounds read, not a write, so it does not provide direct remote code execution but may aid in further attacks by corrupting the interpretation of lock metadata.

All Linux kernel installations that include the cls_lock_client.c decode_lockers function before the patch commit a109a556 or its equivalents are potentially vulnerable. The advisory refers to the generic Linux kernel product. No explicit version ranges are given, so any kernel version older than the commit is considered at risk until updated.

With a CVSS score of 9.8 the vulnerability is classified as critical, although the EPSS score of <1% indicates a low probability of exploitation in the wild. The flaw requires a malicious or compromised Ceph OSD to send a malformed lock.get_info request to a kernel client. If the OSD is trusted within a multi‑tenant Ceph deployment, attackers can trigger the out-of-bounds reads and read sensitive kernel information or influence lock behavior. The vulnerability is listed as not in the CISA KEV catalog, but its high severity and potential to compromise cluster security suggest that affected environments should apply the fix promptly.