A critical out-of-bounds write vulnerability in the Linux kernel libceph component could allow remote attackers to cause memory corruption or arbitrary code execution.

The libceph module fails to validate CRUSH bucket IDs against their array slots, allowing a malformed map to force a bucket to reuse another bucket's workspace. This results in a slab out-of-bounds write when processing uniform buckets, which can be triggered by an unauthenticated attacker.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for severe impact on system integrity and availability. Successful exploitation could lead to kernel-level memory corruption, resulting in system crashes, denial of service, or potentially remote code execution with elevated privileges. Given the critical nature of the Linux kernel, this flaw poses a significant risk to the security posture of any infrastructure relying on Ceph storage integration.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, or 7.2.4 or later, as these versions contain the necessary validation logic to reject mismatched CRUSH IDs.

Proactive Monitoring: Monitor system logs for kernel panics or KASAN-related reports, particularly if they reference libceph or CRUSH map processing errors.

Compensating Controls: Restrict access to Ceph storage management interfaces and ensure that only trusted sources can supply or modify CRUSH maps within the network environment.

Public Exploit Available: Unknown

Due to the critical severity and the potential for kernel-level exploitation, organizations should prioritize patching affected systems. Administrators must verify their kernel versions and apply the provided updates during the next maintenance window to eliminate this attack vector.