The vulnerability is a null-pointer dereference that occurs in the Linux kernel’s Ceph client stack. When an authentication reply message containing zero values for both protocol and result arrives while negotiation is active, the code clears the protocol field and sets the ops pointer to NULL. It then skips protocol initialization and later attempts to call ac->ops->handle_reply(), dereferencing a NULL pointer. This can crash the kernel, leading to denial of service or privilege escalation if an attacker can trigger the vulnerability.

Affected systems are Linux kernel implementations that include the Ceph client stack. The specific kernel versions impacted are not listed in the advisory, and the vulnerability is considered a kernel-level flaw that may affect generic distributions that ship the stock kernel. Any system running the vulnerable Ceph code path before the patch is susceptible.

The CVSS score is not provided, but the nature of a kernel null‑pointer dereference generally implies high severity. The EPSS score is unavailable and the issue is not listed in CISA KEV. Attackers could trigger the flaw over the network by sending a crafted CEPH_MSG_AUTH_REPLY message from a Ceph client or manager. No authentication assumptions are required beyond establishing an authentication negotiation. The risk remains high until the patch is deployed.