The Linux kernel libceph subsystem contains a logic flaw where the function calc_target() fails to set the paused flag for linger requests, only clearing it. This oversight prevents the system from marking certain requests as paused, causing watches to miss the re‑establishment of event notifications. As a result, the rbd_dev->watch_mutex remains held indefinitely during an rbd_unmap operation, making the operation hang in a D state and effectively rendering the associated RBD image unusable. The flaw does not crash the kernel but induces a deadlock that freezes key RBD functionalities.

The vulnerability exists in the Linux kernel’s Ceph RBD subsystem (libceph). No specific kernel version range is listed, so any kernel build using the affected libceph code is potentially impacted.

The CVSS base score of 7.0 reflects a moderate‑high severity. The EPSS value of < 1% indicates a very low probability of exploitation at the time of analysis, and the vulnerability is not yet present in CISA’s KEV catalog. Exploitation requires the ability to trigger RBD operations such as mounting, unmounting, or sending linger requests, which typically implies local or privileged access. If an attacker can invoke an unmap or a similar action, the kernel can deadlock, resulting in a denial of service that may affect services or applications depending on the affected RBD image. The lack of an unavailable wide‑scale exploitation window suggests that the threat remains theoretical but the impact is serious if the situation arises.