The Linux kernel bug originates when the ceph_mdsc_build_path() function fails to zero‑initialize a ceph_path_info structure that is later freed by ceph_mdsc_free_path_info(). Because the structure can contain garbage values, the free routine may access an incorrect slab cache, provoking a kernel BUG and an infamous oops. The crash can be triggered by any operation that exercises Ceph path resolution, and the author notes that an attacker could potentially exploit this bug to gain elevated privileges. The vulnerability is an uninitialized‑variable flaw that can lead to memory corruption and a use‑after‑free scenario.

The issue is confined to the Linux kernel’s Ceph integration. The example crash was observed on kernel 6.18.12 and the flaw was introduced by commit 15f519e9f883. All kernel releases that incorporate that commit without the missing initializers are affected, while any release that applies the subsequent patch to add the initializers fixes the problem. No vendor‑specific product list beyond the Linux kernel is available.

The EPSS score is < 1%; the vulnerability is not listed in CISA KEV; the CVSS score of 7.8 indicates high severity. Exploitation would require triggering the buggy Ceph code path, which, based on the description, indicates that the likely attack vector is local operations that exercise Ceph path resolution but could also be remote if Ceph clients are exposed. Prompt patching or mitigation is strongly recommended.