The vulnerability allows an attacker who can send crafted Ceph Metadata Server messages to the Linux kernel to trigger an out‑of‑bounds read. The kernel code reads an unvalidated snap_trace_len field and uses it to compute a fake end pointer. With a value of 0xffffffff the kernel will read past the legitimate buffer, exposing kernel memory that may contain sensitive data. This read ultimately feeds into further parsing that may read additional structures, potentially leading to information disclosure or denial of service. The weakness conforms to CWE‑125: Out‑of‑Bounds Read. The impact is significant because it occurs in kernel space; compromised data can be used for privilege escalation or to compromise the host. Although the description explicitly mentions a read and not a write, the kernel’s response to corrupted data can result in more severe consequences such as crashes or further corruption, making the flaw a high‑risk kernel vulnerability.

All Linux kernel implementations that contain the ceph_handle_caps routine are affected, as the issue exists since that code was introduced. The flaw is present in every distribution’s kernel that ships the Ceph integration before the correction. No specific version range is provided; therefore any kernel before the reported patch is vulnerable.

The CVSS score is not listed and the EPSS is unavailable, but the nature of an out‑of‑bounds read in kernel code signifies a high likelihood of exploitation by an attacker able to send malicious Ceph traffic. The attack vector is over the network to a Ceph Metadata Server, and the vulnerability can be triggered with a crafted message that sets msg->hdr.version to 1, bypassing version gating. The absence of the vulnerability from the CISA KEV catalog does not diminish its potential severity, as it remains a classic kernel boundary violation.