The Linux kernel Ceph client contains a null pointer dereference vulnerability (CWE-476) caused by failing to propagate an authentication error from ceph_auth_handle_reply_done() to mon_handle_auth_done(). This oversight leaves the monitor believing authentication succeeded while the kernel has encountered an error, resulting in a false success state (CWE-754). In secure mode, this inconsistent state can trigger a warning during setup_crypto() and cause a NULL pointer dereference in prepare_auth_signature(), which may lead to a kernel panic and therefore a denial of service.

Linux kernels that include the Ceph client module are affected. The vulnerability applies to all kernel releases matching the generic linux:linux_kernel CPE as well as the specific 6.19 release candidates rc1 through rc4. Any machine running a Linux kernel that incorporates Ceph as a built‑in or loadable module falls within the scope.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves manipulating the network traffic between a Ceph monitor and client; by inducing an authentication failure that is not properly reported, an adversary can force the kernel into the vulnerable code path. The effect would be a kernel panic, causing a denial of service on the affected host.