The libceph component of the Linux kernel contains a flaw where the function that decodes choose arguments in a Crush map can dereference a null pointer when a bucket index points to a NULL bucket. This causes the kernel to attempt to access an invalid memory location, leading to a crash and loss of kernel stability. The impact is a denial of service on the affected node.

Linux kernel installations that use Ceph storage via libceph and have not applied the recent commit that fixes the check are affected. The vulnerability is present in any kernel version containing the libceph code before the patch; specific version numbers are not supplied, so all prior kernel releases that handle CEPH_MSG_OSD_MAP messages are considered vulnerable.

The CVSS score is not disclosed and the EPSS is not available, but the vulnerability can crash the kernel when a corrupted CEPH message is processed. An attacker who can inject malformed CEPH_MSG_OSD_MAP traffic into the system might trigger the null-pointer dereference, resulting in a kernel panic and interruption of services. Since the system must be listening for Ceph traffic to be exploitable, the attack vector is the network side of Ceph message handling, which is inferred from the description.