The Linux kernel’s libceph module stores a pointer to an authorizer buffer that is not refreshed after a successful authorizer rebuild. When the buffer is replaced, the old pointer remains in auth->authorizer_buf and can be used by the messenger during a reconnect, causing a KASAN slab‑use‑after‑free error in copy_from_iter() while tcp_sendmsg copies the authorizer. This memory corruption can corrupt kernel memory and may provide an attacker with the ability to run arbitrary code or crash the system. The exploit leverages the kernel’s Ceph messaging subsystem, and the impact is described as a use‑after‑free of internal data used by the kernel.

All Linux kernel installations that include libceph and have not applied the patch that refreshes auth->authorizer_buf and auth->authorizer_buf_len. The specific affected kernel versions are not listed in the CVE data, so any kernel release prior to the update that fixes this issue is presumably affected.

The CVSS score is not disclosed, and EPSS is not available; therefore, a quantitative risk level cannot be established from the current metrics. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, over network communication with a Ceph cluster, as an attacker would need to trigger a service ticket update and subsequent reconnect. Based on the description, it is inferred that an attacker could cause memory corruption that might lead to privilege escalation or denial of service if the control flow can be hijacked.