The vulnerability resides in the Linux kernel’s Ceph client authentication path. The function mon_handle_auth_done() fails to forward an error returned by ceph_auth_handle_reply_done(), causing the kernel to believe the monitor authentication succeeded while an error actually occurred. In secure mode this mismatch can trigger a warning during setup_crypto() and ultimately lead to a NULL pointer dereference in prepare_auth_signature(), which may cause a kernel panic and result in a denial of service.

Systems running Linux kernels that contain the Ceph client module are affected. The general linux:linux_kernel CPE list, together with the specific 6.19 release candidates rc1 through rc4, indicates that those kernel versions are vulnerable. Any machine running a Linux kernel that incorporates Ceph—either as a compiled-in module or as a loadable module—falls within the scope of this vulnerability.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to influence the authentication exchange between a Ceph monitor and client, most plausibly by manipulating traffic on the network. The impact is therefore a potential kernel crash leading to a denial of service, rather than remote code execution.