Remote code execution via signed length conversion

Buffer overflow in the Linux kernel Ceph Messenger v2 before 6.4.5 allows remote attackers to execute code via crafted TCP frames. ceph_decode_32 stores attacker-controlled unsigned segment lengths in signed fd_lens entries; their sum can wrap negative, pass validity checks, allocate an undersized buffer, and drive an out-of-bounds copy. Exploitation requires a kernel Ceph client to initiate a Messenger v2 connection to an attacker-controlled server; successful exploitation executes code in the kernel or crashes the host.