A corrupted Ceph–OSD map can contain object storage device (OSD) indices that are outside the valid range. In the vulnerable kernel code the index from the primary_temp list is not checked before being used in calculation of target OSDs. When this invalid index is employed, the kernel performs array accesses past the bounds of the osd_state, osd_weight, and osd_addr structures, which leads to out-of-bounds memory reads. This exposure can leak sensitive kernel data or potentially trigger a crash, but it is not an out‑of‑bounds write and does not directly allow arbitrary code execution according to the information provided.

The flaw resides purely in the Linux kernel’s Ceph client implementation and applies to any kernel version that incorporates the unpatched Ceph code. No specific version range is listed, implying all kernels before the patch that include the vulnerable Ceph integration may be affected.

The EPSS score is not available and the vulnerability does not appear in the CISA KEV catalog, indicating no documented exploitation cases yet. The exploit vector would require an attacker able to control or inject a malformed OSD map into the cluster traffic that reaches a vulnerable node. While the bug currently results in reads, the kernel memory corruption could be leveraged in conjunction with other kernel weaknesses to achieve higher privileges if an attacker can trigger additional sensitive operations. The risk level is therefore moderate to high in environments where the Ceph client is exposed to potential manipulation.