In the Linux kernel’s Ceph client, an asynchronous unlink operation decrements the inode’s i_nlink counter before the corresponding completion from the metadata server is received. The kernel assumes the unlink request will succeed and performs this decrement immediately. If another client or an earlier completion has already set the link counter to zero, the subsequent decrement causes an underrun, producing a kernel warning and potentially leaving the inode’s link count inconsistent, which can disrupt file system consistency checks and future unlink operations.

Any Linux kernel that includes the Ceph client subsystem and has not incorporated the fix is affected. The vulnerability spans kernel releases that support Ceph; known uncovered versions include 6.14.x and the 7.0 release candidates (rc1–rc3) as listed in the CPE data. The issue exists only in the kernel, with no separate user‑space component.

The CVSS score is 4.7 and the EPSS score is less than 1 %, indicating a low probability of exploitation at the time of assessment. The CVE is not listed in the CISA KEV catalog. Exploitation requires a precise race condition between an asynchronous unlink request and a competing link‑counter update, making reliable exploitation difficult. The risk is therefore moderate, primarily associated with data integrity and availability concerns rather than an immediately actionable attack vector.