An unbounded length field in libceph lets a malicious Ceph monitor craft a pg_temp or pg_upmap entry whose length exceeds the defined maximum. The decoded value is later copied into a fixed‑size on‑stack array, causing a stack out‑of‑bounds write. This buffer overflow can result in a kernel crash or, if executed carefully, arbitrary code execution with kernel privileges. The vulnerability is manifested as a KASAN error and a kernel BUG, indicating high severity.

All Linux kernel installations that include the Ceph kernel module are affected. Whoever runs a Linux distribution with Ceph support in the kernel—regardless of vendor or kernel release—has the potential to be impacted, because the issue is not tied to a specific vendor or version. Any system that communicates with Ceph monitors or receives OSD maps is at risk.

The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the nature of the stack overflow implies significant exploitability. The attack requires an attacker who can inject a malicious OSDMap—typically through a compromised or poorly isolated Ceph monitor. Although the absence of a CVSS score precludes a precise quantitative assessment, the potential for kernel compromise warrants immediate attention.