The vulnerability occurs in the Linux kernel’s Ceph subsystem when folios that are not suitable for writeback are removed from a batch without first releasing their reference via folio_put. The missing reference decrement can corrupt kernel memory. It is inferred that an attacker who succeeds in exploiting this flaw could trigger a kernel panic or cause denial of service for the affected system.

Linux kernel builds that include the Ceph subsystem and have not applied the fix commit are at risk. The fix was validated on kernel version 6.18, suggesting that versions older than 6.18 are potentially affected. Specific kernel releases 7.1 rc1 through rc3 are explicitly listed as vulnerable in the CPE data.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation at present. The advisory does not provide an explicit attack vector. Based on the nature of kernel memory‑corruption bugs, it is inferred that exploitation would likely require local access with elevated privileges.