A critical out-of-bounds write vulnerability in the Linux kernel Ceph filesystem allows a malicious metadata server to trigger memory corruption and potential code execution.

The vulnerability is a slab out-of-bounds write occurring when the kernel copies MDS-supplied dentry names into a fixed-size buffer without validating the input length against NAME_MAX. This flaw is reachable when a CephFS mount is re-exported over NFS, allowing an unauthenticated remote attacker to trigger the overflow.

Successful exploitation of this vulnerability allows an attacker to overwrite sensitive kernel memory, which can lead to system crashes, denial of service, or arbitrary code execution with kernel-level privileges. Given the CVSS score of 9.8, this poses a severe risk to data integrity and system availability. Organizations relying on CephFS for storage infrastructure are at particular risk of complete host compromise.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release that incorporates the upstream fix.

Proactive Monitoring: Monitor system logs for kernel oops, KASAN reports, or unexpected crashes related to the Ceph filesystem or NFS export services.

Compensating Controls: If patching is not immediately feasible, restrict access to Ceph MDS nodes and disable NFS re-export of CephFS mounts to limit the attack surface.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a critical risk to kernel stability and security. Administrators should prioritize patching affected Linux distributions as soon as stable kernel updates are released by their respective vendors. Immediate action is required to eliminate the possibility of kernel-level memory corruption and subsequent system compromise.