The vulnerability resides in libceph’s crush_decode function where CRUSH bucket type 0 is incorrectly accepted. CRUSH bucket type 0 is reserved for device nodes; the function allows a malformed map containing a type‑0 bucket, causing the mapper to treat a negative bucket ID as a device and pass it to is_out(). This leads to indexing the OSD weight array with a negative value, resulting in an out‑of‑bounds array access that can corrupt kernel memory.

All Linux kernel releases that include the libceph module before the patched commit are potentially affected. No specific kernel version ranges are listed, so any distribution kernel containing libceph code that has not incorporated the fix remains vulnerable.

The CVSS score of 9.8 indicates a critical severity vulnerability. The EPSS score is less than 1 %, and the issue is not listed in CISA’s KEV catalog, suggesting a low likelihood of widespread exploitation. Based on the description, it is inferred that an attacker would need to supply a malicious CRUSH map, typically by compromising a Ceph client or gaining administrative access to the Ceph management interface. Consequently, the exploitation is likely limited to local or privileged attackers. If exploited, the out-of-bounds array access could corrupt kernel memory and potentially allow the attacker to execute arbitrary code or elevate privileges.