The vulnerability lies in the Linux kernel’s handling of Ceph snapshot directories. When a user lists a .snap directory, the function parse_longname() advances a pointer past an underscore and then calls kfree() on that advanced pointer. Because the pointer is not the original allocation reference, the kernel attempts to free invalid memory, triggering an oops. The crash effectively brings the kernel to a halt, disrupting all processes and requiring a system reboot. No remote code execution or data exfiltration is possible, but the denial of service can be critical for production environments that rely on CephFS.

Affected systems are Linux kernel builds that include the unpatched parse_longname() code, notably all 6.19 release candidates from rc1 through rc8 and any subsequent kernel versions until the patch is applied. Any kernel that mounts a Ceph filesystem and enumerates its .snap directories is susceptible. The issue manifests during normal operations such as running 'ls /mnt/<ceph_mount>/.snap' or accessing the snapshot list through a Ceph client.

The CVSS score of 5.5 indicates a moderate impact, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attack requires local access to a machine that can mount the affected CephFS and enumerate snapshots, implying a local threat model rather than remote exploitation. The bug results in a kernel crash rather than privilege escalation or data loss, but the denial of service can have significant operational consequences.