The vulnerability resides in the free_choose_arg_map() function in the Linux kernel’s libceph subsystem. When the allocation of arg_map->args fails, the caller can still set arg_map->size to a non‑zero value and then jump to the failure path. During cleanup, free_choose_arg_map() iterates over arg_map->args and dereferences a NULL pointer, which triggers a kernel fault. This manifests as a system crash and therefore results in a denial of service. The weakness is a classic NULL pointer dereference (CWE‑476).

All builds of the Linux Kernel that include the vulnerable libceph code are affected, specifically the 6.19 release candidates (rc1 through rc4) and any kernel versions derived from them before the patch was backported. Upgrading to a later release that contains the fix removes the vulnerability.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows that this issue is considered unlikely to be exploited in the near term. It is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been observed. The attack would likely require the ability to trigger the partial allocation failure path in the Ceph subsystem, which may be achieved locally by interacting with a Ceph client or potentially remotely if the Ceph interface is exposed. Based on the description, the attack vector is inferred to involve inducing a failure in decode_choose_args(), leading to the null dereference and subsequent crash.