The Linux kernel’s libceph implementation contains a flaw involving CWE-20 that incorrectly accepts a CEPH_MSG_MON_MAP with a monitor count of zero as valid. When such a malformed monmap reaches the client, the kernel establishes a session to a nonexistent monitor, causing the BUG_ON assertion in __open_session() to trigger and the client to crash. This results in an immediate denial of service for any Ceph client relying on the kernel’s Ceph stack.

Any Linux kernel distribution that includes libceph and supports the Ceph client is affected. Kernel builds with Ceph support but lacking the recent patch that rejects zero‑monitor monmaps are vulnerable. Version details are not provided, so all unpatched current releases remain at risk.

The CVSS score of 7.5 classifies this issue as High severity while the EPSS score of <1% indicates a low probability of exploitation. The flaw involves CWE-20 weaknesses. The likely attack vector is delivering a malformed CEPH_MSG_MON_MAP, as inferred from the description, which requires an attacker to control a Ceph monitor or inject messages into the client’s monitor communication channel. The CVE is not included in CISA’s KEV catalog, and the attack surface is limited to trusted or locally reachable monitors, making exploitation relatively constrained.