The vulnerability in the Linux kernel's Ceph client occurs in handle_session(), which decodes MDSCapAuth records from CEPH_SESSION_OPEN messages. The match.path and match.fs_name fields are decoded by reading a 32-bit length and copying bytes without prior bounds checking, unlike other fields that use safe decode variants. This allows a malicious or compromised MDS to send a crafted message with an excessive length, causing ceph_decode_copy() to read beyond the allocated message front buffer (kvmalloc allocation). This out-of-bounds read can reach up to 4 GiB, leading to a kernel client crash. The fix replaces the unsafe copies with ceph_decode_copy_safe(), which performs bounds checks and branches to error handling, preventing the out-of-bounds read.

A malicious or compromised Metadata Server (MDS) can exploit this vulnerability to cause the Linux kernel Ceph client to perform an out-of-bounds read of up to 4 GiB during session setup. This can crash the client kernel, resulting in denial of service. There is no indication of code execution or data corruption beyond the crash from the provided information.

A fix is available that switches the unsafe decode operations to safe variants performing proper bounds checking and error handling. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.