A vulnerability in the Linux kernel Ceph implementation allows a compromised or malicious metadata server to trigger a denial of service via memory exhaustion.

This is an improper input validation vulnerability where the kernel fails to cap the number of delegated inodes parsed from a Ceph MDS reply. An unauthenticated attacker in control of a malicious MDS can send crafted network packets to force the kernel into an infinite loop or cause uncontrolled memory growth, leading to a denial of service.

The potential for a denial of service attack against the kernel poses a significant threat to system stability and availability. Because the vulnerability allows for resource exhaustion, it could effectively crash critical storage infrastructure, leading to operational downtime and potential data loss in Ceph-dependent environments. Given the CVSS score of 7.5, this is considered a high-severity issue that requires prompt attention to maintain service continuity.

Immediate Action: Update the Linux kernel to version 6.18.51, 7.2.4, or later versions where the inode delegation limit is strictly enforced.

Proactive Monitoring: Monitor system logs for unusual kernel warnings related to Ceph or unexpected spikes in memory usage by kernel processes.

Compensating Controls: Restrict network access to the Ceph MDS, ensuring that only trusted metadata servers can communicate with the client systems.

Public Exploit Available: Unknown

Organizations utilizing the Ceph file system within their Linux environments should prioritize patching their kernel to the specified versions. Given that this vulnerability allows for remote denial of service, applying the update is essential to protect critical storage availability. Ensure that all production nodes are updated and verified according to your standard patch management lifecycle.