In the Linux kernel’s libceph module, the multiplication of the length field when decoding CEPH_MSG_OSD_MAP messages can overflow. This integer overflow causes an incorrect bounds check for the new_state part of the message, leading to out-of-bounds reads of kernel memory. An attacker could therefore obtain sensitive kernel data or trigger a crash, resulting in potential information disclosure or denial of service. The weakness is a classic out-of-bounds read (CWE-125).

The flaw resides in the libceph component of the Linux kernel, so any kernel that includes libceph and processes CEPH_MSG_OSD_MAP messages may be affected. All kernel builds before the introduction of the check_mul_overflow patch are potentially vulnerable, including typical Ceph OSD, client, and monitor nodes running common Linux distributions.

Based on the description, it is inferred that the likely attack vector is via a malicious CEPH_MSG_OSD_MAP message that an attacker can inject over the network into a Ceph cluster. The CVSS score of 9.8 places the vulnerability in the critical severity range, while the EPSS score of <1% indicates a low current likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, suggesting limited or no widespread exploitation. An attacker with network access to Ceph traffic that reaches a vulnerable kernel could exploit the overflow, enabling out-of-bounds reads before the kernel aborts further processing, potentially leaking kernel memory contents or causing a system crash.