The vulnerability occurs when the libceph handler for Ceph MON_GET_VERSION replies decodes the reply using the buffer’s allocated size rather than the actual number of bytes received. A truncated reply can then pass a bounds check and trigger an out‑of‑bounds read of stale data left from a previous message, causing an uninitialized memory read. This can leak kernel memory contents and expose sensitive data. The flaw does not provide direct code execution but can be leveraged to gain information that facilitates further attacks.

All Linux kernels that include the libceph component prior to the patch are affected. Exact affected versions are not given, so any kernel in which handle_get_version_reply() is present before the upstream change is considered vulnerable.

The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and has a CVSS score of 8.6, indicating high severity. Based on the description, it is inferred that exploitation would require a maliciously crafted MON_GET_VERSION reply delivered to a kernel process, implying a local or network‑based attack vector. Because the disclosure is limited to uninitialized memory, the impact is primarily information disclosure, which could assist additional privilege‑escalation techniques if available.