__build_xattrs() in the Linux kernel's Ceph filesystem decodes extended attributes from a metadata server-supplied blob. While length fields are checked for each attribute, the final attribute's value length is not verified against the blob boundary, allowing a malicious metadata server to specify an oversized length. This causes __set_xattr() to record an invalid length, leading to a memcpy() that copies beyond the allocated buffer into user space during getxattr(2). The vulnerability enables local users to read adjacent kernel heap memory. The fix adds a missing ceph_decode_need() check to ensure the final attribute's value length does not exceed the blob size, causing decoding to fail safely if it does.

A malicious or compromised Ceph metadata server can cause the kernel to disclose adjacent kernel heap memory to a local user through the getxattr(2) system call on a CephFS file. This results in an information disclosure vulnerability allowing local users to read unintended kernel memory contents.

A fix has been implemented that adds the missing bounds check for the final xattr value length in __build_xattrs(). Systems should apply the official kernel update containing this patch to prevent out-of-bounds reads and information disclosure. No other mitigation is indicated.