The Linux kernel bug originates when the ceph_mdsc_build_path() function fails to zero‑initialize a ceph_path_info structure that is later freed by ceph_mdsc_free_path_info(). Because the structure can contain garbage values, the free routine may access an incorrect slab cache, provoking a kernel BUG and an infamous oops. The crash can be triggered by any operation that exercises Ceph path resolution, and the author notes that an attacker could potentially exploit this defect to gain elevated privileges. The vulnerability is an uninitialized‑variable flaw that can lead to memory corruption and a use‑after‑free scenario.

The issue is confined to the Linux kernel's Ceph integration. The example crash was observed on kernel 6.18.12 and the flaw was introduced by commit 15f519e9f883. All kernel releases that incorporate that commit without the missing initializers are affected, while any release that applies the subsequent patch to add the initializers fixes the problem. No vendor‑specific product list beyond the Linux kernel is available.

The EPSS score is not available, the KEV flag indicates the vulnerability is not listed in CISA KEV, and the CVSS score of 7.0 indicates a high severity. Exploitation would require triggering the buggy Ceph code path, which is likely a local or remote vector depending on the Ceph client configuration. Prompt patching or mitigation is strongly recommended.