A critical out-of-bounds read vulnerability in the Linux kernel ceph driver allows unauthenticated remote attackers to potentially trigger memory corruption or information disclosure.

The ceph_mdsmap_decode function fails to properly validate the num_export_targets field when decoding MDS map messages, leading to an out-of-bounds memory read. An unauthenticated attacker, such as a malicious monitor or an on-path attacker on an unencrypted session, can supply a crafted message to trigger this memory access error.

This vulnerability carries a CVSS score of 9.1, indicating a critical severity level. Successful exploitation could lead to significant system instability or denial of service, and potentially allow an attacker to read sensitive kernel memory contents. Such an impact poses a severe risk to data confidentiality and service availability, particularly for systems utilizing Ceph storage clusters.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later to incorporate the necessary bounds checking.

Proactive Monitoring: Review system logs for kernel crashes or memory-related errors, particularly those referencing ceph or mdsmap modules.

Compensating Controls: Ensure all Ceph messenger traffic is configured with encryption and authentication to prevent on-path attackers from injecting malicious MDS map messages.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this kernel-level memory vulnerability, immediate patching is required to prevent potential system compromise. Organizations relying on Ceph storage should prioritize kernel updates across all affected nodes to eliminate the risk of unauthenticated out-of-bounds read attacks.