A BUG_ON in the kernel’s Ceph xattr handling function __ceph_build_xattrs_blob is triggered when the function processes an outdated or stale blob size. The failure causes a kernel panic that brings the entire system down, interrupting all services. This flaw arises from a race condition involving the release and reacquisition of an internal Ceph lock during attribute building, which allows an attacker to corrupt the blob data and force the assertion failure. It matches known weakness types related to concurrent execution and unexpected crashes.

The flaw is present in Linux kernel versions that ship the Ceph filesystem code before the patch that moved the required_blob_size calculation to prior to the attribute build. Any distribution using a kernel with that unpatched Ceph implementation is affected; recent test builds such as 7.0.0‑rc7 exhibit the crash when a Ceph client operation exercises the race. Exact version ranges are not enumerated, so administrators should verify that their running kernel contains the commit that protects the blob size calculation.

The CVSS and EPSS metrics are not available, and the CVE is not listed in the CISA KEV catalog. Despite the high impact of a kernel crash, exploitation requires provoking the specific race window in Ceph, typically by sending crafted client messages or by manipulating capability grants. This limitation lowers the probability that a remote attacker could easily trigger the crash; however, a local user with elevated privileges or an adversary controlling Ceph cluster traffic could attempt timed requests to exploit the bug. Nonetheless, the lack of known public exploits and the specialized conditions keep the overall exploitation risk modest, but the potential downtime makes the vulnerability still serious.