The bug resides in the decode_lockers() routine of libceph where two unsafe decode calls lack bounds checks. This oversight permits a malicious or compromised Ceph OSD to send crafted lock.get_info requests that cause the kernel to read 4 or 1 bytes beyond a validated buffer. The attacker can inject arbitrary values for the locker count and the lock type field, resulting in unauthorized kernel memory disclosure and potential manipulation of lock semantics.

All Linux kernel installations that include the cls_lock_client.c decode_lockers function prior to the applied patch are affected. The CNA lists Linux:Linux as the vendor, and the CPE identifies the generic Linux kernel. Explicit version ranges are not specified in the advisory, so any pre‑patch kernel is potentially vulnerable.

Without an official KEV listing or EPSS score, the exact exploitation probability is unclear, but the vulnerability is a classic buffer-overread that could expose kernel memory. The attack vector requires a malicious or compromised OSD in a multi-tenant Ceph environment to issue a malformed lock.get_info RPC. The bug could be leveraged for information disclosure and to influence lock type decisions but would not provide direct remote code execution without additional weaknesses. The risk remains high for exposed clusters until the kernel is patched.