The vulnerability arises when the Ceph client calls d_add(dentry, NULL) on a negative dentry that is already hashed in the dcache. This misuse causes the existing hash entry for that dentry to be reinserted into the hash bucket, creating a self‑loop in the kernel's hash list. When the kernel later performs a lookup, the walk can spin indefinitely, eventually triggering an RCU stall that renders the system unresponsive. The bug can result in a denial of service by exhausting CPU resources and is triggered through Ceph lookup or atomic_open operations that reuse cached negative dentries.

All Linux kernel builds that include the Ceph filesystem and contain the vulnerable fs/ceph/dir.c paths are affected. The CPE shows all linux_kernel products, and no specific vendor or version ranges are listed, so any distribution using a kernel prior to the patch for this issue (e.g., kernel 6.18.x and earlier) is potentially impacted. The bug is present in the upstream kernel and thus applies to all major Linux distributions that ship that kernel version unchanged.

The exploit requires successful reuse of a cached negative dentry, which can be achieved by traffic to a Ceph cluster that performs lookups. Because the vulnerability corrupts internal kernel data structures, it is likely to be exploitable by any user with ability to cause the Ceph client to exercise the problematic code paths, making the risk significant. The lack of an EPSS score and absence from the KEV catalog do not diminish the potential impact; the consequence is a full system halt and loss of availability.