This vulnerability is an integer multiplication overflow in the Linux kernel’s libceph module when decoding CEPH_MSG_OSD_MAP messages; a maliciously crafted message can cause the length calculation for the new_state part to wrap, leading to an incorrect bounds check and subsequent out‑of‑bounds reads that could disclose kernel memory contents or cause a crash, resulting in potential information disclosure or denial of service.

The flaw resides in the libceph component of the Linux kernel; any kernel build that includes libceph and processes CEPH_MSG_OSD_MAP messages may be affected, and no specific version is listed, so all kernels shipping libceph before the patch that switches to check_mul_overflow() are potentially vulnerable.

An attacker with network access to a Ceph cluster that a vulnerable kernel participates in can craft a CEPH_MSG_OSD_MAP message to trigger the overflow; while the kernel aborts processing upon detection, the vulnerability still permits information disclosure or denial of service, and the lack of an EPSS score and absence from the CISA KEV catalog suggest that widespread exploitation has not been reported.