A malformed or malicious CEPH message containing duplicate CRUSH choose‑args indices can trigger an assertion in the kernel’s rbtree insertion logic. When the second duplicate entry is processed, the kernel fires a BUG and panics, causing a system crash. The vulnerability does not provide a path to arbitrary code execution, but it can be used to force a restart of the affected host, disrupting availability of services that rely on a stable kernel.

The flaw resides in the Linux kernel’s libceph module and affects any Linux system that operates a Ceph storage cluster. No specific kernel release is listed, so all kernels that compile the affected libceph code are potentially impacted until a patch is applied.

The CVSS score for this issue is not provided, but the potential impact is high due to the kernel panic. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, whereby an attacker sends a crafted CEPH OSD map message to a cluster node, triggering the kernel BUG. Because Ceph communication typically occurs over untrusted networks, the risk remains significant until the kernel is updated.