The bug lives in the Linux kernel’s libceph module and triggers when a connection fault or error occurs during a sparse‑read reply. Because the sparse‑read state machine is not reset, the client treats the beginning of a new reply as a continuation of the previous one, resulting in repeated socket errors and an endless loop. The victim process can become stuck, exhausting CPU and network resources, effectively denying service to the Ceph OSD client and potentially impacting cluster availability.

All Linux kernels that ship with the Ceph client are impacted, including the generic Linux kernel and the specific 6.19 release candidates (rc1 through rc4). Any system running those kernel versions and using libceph without the fix is vulnerable.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector involves inducing repeated connection faults—either through network disruption or a malicious OSD sending malformed data—so that the faulty state remains for long periods. Once triggered, the kernel enters a loop that cannot recover until a reset occurs. The official mitigation is a kernel patch that resets the sparse‑read state in osd_fault(); without it, the loop can persist until a system reboot or manual intervention.