In the Linux kernel’s Ceph file system, an asynchronous unlink operation decreases the inode’s link counter before the corresponding completion from the metadata server is received. The kernel assumes the unlink will succeed and performs this decrement immediately. If another client or an earlier completion has already set the link counter to zero, the decrement causes an underrun, resulting in a kernel warning and potentially leaving the inode’s link count inconsistent, which could affect file system consistency checks and subsequent unlink behavior.

Any Linux kernel that includes the Ceph file system driver and has not incorporated the fix is affected. The vulnerability is independent of specific distributions and applies to all kernel releases running Ceph until patched; it only impacts the kernel, with no separate user‑space component.

The CVSS score is 7.0, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of active exploitation. The defect requires a race condition between an asynchronous unlink request and another client’s link counter update; achieving a reliable exploit would require precise timing and concurrent operations. Consequently, the risk is moderate and primarily associated with data integrity and availability concerns rather than a readily exploitable attack vector.