The vulnerability in the Linux kernel's libceph subsystem relates to the handling of CRUSH bucket IDs during decoding. The function crush_decode() stores bucket data by array slot, and the mapper derives workspace indices from decoded bucket IDs. Malformed CRUSH maps can encode bucket IDs that differ from the canonical negative ID corresponding to the bucket slot, causing one bucket to reuse another's workspace buffer. For uniform buckets, this leads to a write beyond the allocated permutation array size, resulting in a 4-byte slab out-of-bounds write detected by KASAN in bucket_perm_choose(). The resolution rejects buckets whose encoded ID does not match their array slot, restoring the expected invariant and preventing out-of-bounds writes.

This vulnerability can cause out-of-bounds memory writes in kernel space, potentially leading to memory corruption or instability. However, exploitation requires a malformed CRUSH map, which is part of the Ceph storage cluster map configuration. There are no known exploits in the wild. The impact is limited to systems using the affected libceph code in the Linux kernel.

A fix has been implemented that rejects CRUSH buckets with mismatched encoded IDs, restoring the expected invariant and preventing out-of-bounds writes. Users should apply the official Linux kernel update that includes this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.