A missing bounds check in libceph’s decode_watchers() can cause the Linux kernel to read four bytes beyond the validated buffer when a Ceph OSD replies with a struct_len of zero. The garbage value read is passed directly to kzalloc_objs() as a watcher count, potentially leading to an excessive allocation that can crash or exhaust kernel memory, resulting in denial of service for any client employing CEPH_OSD_OP_LIST_WATCHERS.

The vulnerability is present in all Linux kernel builds that include the affected libceph code paths, regardless of kernel version, until the recent upstream patch is applied. Any host running a Ceph client against a Ceph OSD that can send the crafted obj_list_watch_response_t is susceptible. The fix is incorporated into newer kernel releases and can be obtained by upgrading the kernel.

An attacker only needs a malicious or compromised Ceph OSD node within the same Ceph cluster. By sending a crafted obj_list_watch_response_t the attacker can trigger the flaw over the normal Ceph control network without elevated privileges. EPSS is not available and the CVE is not listed in CISA KEV, but the kernel‑level out-of-bounds read and potential crash give the flaw a high severity. The main constraint is that the attacker must be able to reach the kernel client, typically via the internal cluster network.