The vulnerability resides in libceph’s crush_decode function. CRUSH bucket type 0 is reserved for device nodes, but the function currently accepts bucket entries with type 0. A crafted CRUSH map can pass a negative bucket ID to the mapper, which then calls is_out() and indexes the OSD weight array with a negative value. This out‑of‑bounds access can corrupt kernel memory, potentially allowing an attacker to execute arbitrary code or gain kernel privileges. The weakness is an array index out‑of‑bounds error, classified as CWE‑129.

All Linux kernel releases that include the libceph module before the patched commit are potentially affected. No specific kernel version ranges are listed, so any distribution kernel containing libceph code that has not incorporated the fix remains vulnerable.

The CVSS score and EPSS probability are not published, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the flaw permits kernel memory corruption, a high‑impact security issue. An attacker must be able to supply a malformed CRUSH map – typically through a Ceph administrator interface or by compromising a Ceph client – implying a local or privileged attacker can exploit the issue. The lack of public exploit metrics does not diminish the inherent risk of the vulnerability.