Linux Kernel EUVD-2026-76568

Requires a mounted Ceph RADOS client (RBD block device or CephFS) that decodes CRUSH maps, plus the ability to deliver a malformed CRUSH/OSD map - i.e. a malicious or compromised Ceph monitor, or a man-in-the-middle position on a messenger session that is not authenticated/signed (cephx or msgr2 secure mode disabled). The malformed map must encode a uniform bucket whose id differs from '-1 - slot' and whose source bucket is larger than the aliased bucket. Limiting factors: the data is control-plane (monitor) sourced rather than attacker-arbitrary over the open internet, no user interaction, no client authentication needed on the receiving side, and the effect is memory corruption/crash (DoS-leaning) rather than confirmed information disclosure; kernels before the vulnerable commit / after the fixed versions are not affected.

The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk: the malicious data is a CRUSH/OSD map that only reaches the client from the Ceph monitor cluster, so the realistic vector is adjacent and gated (a compromised/rogue monitor, or MITM on an unsigned/unencrypted messenger session) with meaningful attack complexity - closer to AV:A/AC:H, and the 4-byte OOB write is DoS-leaning rather than a clean C:H info-leak, so 'Information Disclosure' mislabels an OOB write. Supporting signals point the same way: EPSS 0.17% (6th percentile) is low, the CVE is not in CISA KEV, and no public PoC is identified. That said, in a Ceph environment the monitor is a trusted control-plane component whose compromise is high-impact, so even a mid-sized municipal IT team in gdynia running a CephFS/RBD cluster should treat monitor hardening and kernel patching as urgent rather than dismiss the low EPSS. Net: a legitimate patch-soon item for Ceph clients, not a broadly-scanned internet-facing emergency.

An attacker who controls or has compromised a Ceph monitor (or can MITM an unauthenticated/unsigned messenger session) publishes a crafted OSD/CRUSH map containing a uniform bucket whose encoded id does not match its slot. When a mounted RBD or CephFS client decodes the map and runs placement, bucket_perm_choose() writes a source bucket's permutation into a smaller aliased workspace buffer, corrupting adjacent slab memory and typically crashing the client kernel. No public exploit code is identified at time of analysis.