The vulnerability lies in the Linux kernel’s libceph module. A corrupted CEPH OSD_MAP message can contain duplicate CRUSH choose‑args indices. When decode_choose_args() attempts to insert the second entry into the rbtree, an assertion inside insert_choose_arg_map() fires a BUG, triggering a kernel panic. This results in an abrupt crash of the affected system and a loss of availability for any services relying on that node. The weakness stems from inadequate input validation (CWE‑20) and improper handling of duplicate keys in the rbtree (CWE‑617). No code execution or privilege escalation is possible beyond the denial‑of‑service effect.

All Linux kernel releases that compile the libceph code without the upstream patch are affected. The fix is already present in recent stable releases, but earlier kernels—including 7.1 release candidates 1 through 3 and other distribution kernels that have not backported the change—remain vulnerable. The issue is relevant to any Linux host participating in a Ceph storage cluster or handling CEPH traffic, whether it is a Ceph OSD, monitor, or client node.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1 % reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is delivering a crafted CEPH OSD_MAP packet over a network to a node that accepts Ceph traffic; this inference assumes an attacker can reach the target’s Ceph interface. Exploitation would require network access and the ability to send the malformed message. The resulting kernel panic produces a denial‑of‑service, but no persistence or credential compromise occurs.