The vulnerability exists in the Linux kernel's Ceph filesystem client, specifically in the ceph_mdsmap_decode() function within fs/ceph/mdsmap.c. The function reads the num_export_targets field from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without verifying that sufficient bytes remain in the buffer for info versions 2 and 3. The only upper-bound check is applied for info_v >= 4, leaving earlier versions unchecked. A malicious or compromised Ceph monitor can send an MDS map with an oversized num_export_targets value, causing the decode cursor to move beyond the buffer boundary and leading to an out-of-bounds read in kernel memory. The decoded values are stored in the internal export_targets array, resulting in a kernel slab-out-of-bounds read on x86_64 systems with KASAN enabled. The vulnerability does not cause an information leak to the attacker. The fix involves adding a bounds check for all info versions >= 2 and safely computing the byte count to prevent overflow.

A malicious or compromised Ceph monitor or an attacker on an unencrypted or unsigned messenger session can trigger an out-of-bounds read in the CephFS client kernel by sending a crafted MDS map with an oversized num_export_targets field for per-mds info versions 2 or 3. This results in a kernel out-of-bounds read, which may cause instability or crashes but does not lead to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding proper bounds checking for the num_export_targets array for info versions 2 and 3 and safely computing the byte count to prevent overflow. Until an official patch is applied, avoid using untrusted or compromised Ceph monitors and ensure messenger sessions are signed and encrypted to prevent on-path attacks.