The flaw lies in the libceph component of the Linux kernel. During decoding of CEPH_MSG_OSD_MAP messages, the function decode_new_up_state_weight() multiplies a length field read from the incoming message. This multiplication can overflow, allowing the bounds check for the new_state portion to be bypassed. The result is an out‑of‑bounds read of sensitive kernel memory, which may lead to data leakage or a crash. The weakness is an integer overflow tied to an out‑of‑bounds read (CWE‑190, CWE‑125).

All kernel releases containing libceph that process CEPH_MSG_OSD_MAP messages are affected. This includes typical Ceph OSD, client, and monitor nodes running common Linux distributions before the patch that introduces check_mul_overflow. Any system whose kernel has not yet been updated to a version that contains the fix is potentially vulnerable.

The CVSS score of 9.8 places the vulnerability in the critical severity range, and the EPSS score of <1% indicates a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to inject a malformed CEPH_MSG_OSD_MAP message into a Ceph cluster that reaches a vulnerable kernel, thus manipulating the integer overflow to read out‑of‑bounds kernel memory or cause a kernel abort. Once the overflow is detected, processing is aborted, but the read can happen beforehand, allowing potential information leakage or denial of service.