An improper error handling path in the Linux kernel’s RBD subsystem caused a double teardown of a block device when device_add_disk() failed after device_add() had succeeded. The bug resulted in the blk-mq cleanup code executing on freed or uninitialized memory, producing a null‑ptr‑deref in __blk_mq_free_map_and_rqs(), which manifested as a general protection fault and kernel panic, effectively crashing the host. An attacker could trigger the failure by supplying a deliberately malformed RBD image or manipulating the /sys/bus/rbd/add_single_major interface, thereby exercising the faulty cleanup path.

All versions of the Linux kernel prior to the patch—including v6.13‑rc1, v7.0 and earlier—are vulnerable. Kernel releases that incorporate the commit that added device_del() before rbd_dev_device_release() are not affected. The CVE applies to any Linux deployment with RBD support enabled and write access to the sysfs interface used for adding RBD devices.

The CVSS score is not listed and the EPSS score is unavailable, but the issue has been reproduced reliably and causes a kernel crash. Exploitation requires interaction with the Ceph RBD subsystem, suggesting a local or privileged attack surface; this is inferred because access to write to /sys/bus/rbd interface is typically restricted to privileged users. The likely attack vector is through the /sys/bus/rbd/add_single_major interface, which is inferred from the description of the bug reproduction. There is no publicly available exploit and the vulnerability is not in CISA’s KEV catalog. Nonetheless, the cost of a crash is high, so the rating is treated as a serious defect with uncertain but non‑negligible exploitation probability.