The vulnerability in the Linux kernel's Ceph client occurred in the ceph_parse_deleg_inos() function, which decodes delegated inode intervals from MDS replies. The length parameter 'len' is attacker-controlled and was not properly bounded, allowing a malicious or compromised MDS to send large or duplicate intervals that cause the client to spin in an insert loop or grow the xarray data structure without limit. The fix enforces a single atomic counter per MDS session to cap the number of delegated inodes and also caps the aggregate interval length per reply. This prevents unbounded CPU usage and memory growth caused by malformed delegation streams.

A malicious or compromised Ceph MDS could previously cause a Linux kernel client to consume excessive CPU and memory resources by sending crafted delegation replies with large or duplicate inode intervals. This could lead to denial of service conditions on the client due to spinning loops or unbounded memory growth. The vulnerability affects the Ceph client code in the Linux kernel and could be exploited by an attacker controlling or compromising the MDS.

A fix has been implemented that caps the number of delegated inodes per MDS session and limits the aggregate interval length per reply, preventing unbounded resource consumption. Users should apply the official Linux kernel update that includes this patch to mitigate the vulnerability. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the input; check the vendor advisory for current remediation guidance.