A critical vulnerability in the Linux kernel libceph library allows unauthenticated remote attackers to trigger memory corruption via malformed network traffic.

The libceph implementation of decode_locker in cls_lock_client.c fails to perform necessary bounds checks on incoming data, allowing an unauthenticated OSD to perform out-of-bounds memory reads and potentially escalate privileges or crash the system.

Successful exploitation of this vulnerability poses a severe risk to data integrity and system availability. Because the Linux kernel resides at the highest level of system privilege, an attacker gaining control through memory corruption can execute arbitrary code, bypass security controls, or cause a kernel panic, leading to significant operational downtime and potential compromise of sensitive data across multi-tenant environments. The CVSS score of 9.8 reflects the critical nature of this flaw, as it requires no user interaction or authentication to trigger.

Immediate Action: Update your Linux kernel to the versions specified in the OSV fixed packages (e.g., 5.10.266, 5.15.217, 6.1.184, or 6.6.153) immediately to incorporate the necessary bounds checking patches.

Proactive Monitoring: Monitor system logs for kernel-related memory errors or unexpected service crashes, and track OSD communication patterns for malformed Ceph protocol traffic.

Compensating Controls: Restrict network access to the Ceph cluster, ensuring that only trusted OSD nodes can communicate with kernel clients, which reduces the attack surface for this specific vector.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to infrastructure relying on Ceph storage. System administrators must prioritize patching the kernel to the latest stable release. Given the ease of triggering this flaw through malformed OSD traffic, delayed patching leaves the environment vulnerable to memory corruption attacks that can be difficult to detect once system integrity is compromised.