The Linux kernel’s libceph implementation contains a CWE-617 flaw that incorrectly accepts a CEPH_MSG_MON_MAP with a monitor count of zero as valid. When such a malformed monmap reaches the client, the kernel establishes a session to a nonexistent monitor, causing the BUG_ON assertion in __open_session() to fire and the client to crash. This results in an immediate denial of service for any Ceph client relying on the kernel’s Ceph stack.

Any Linux kernel distribution that includes libceph and supports the Ceph client is impacted. Kernel builds with Ceph support but missing the recent patch that rejects zero‑monitor monmaps are vulnerable. Version details are not listed, so all unpatched current releases remain at risk.

The CVSS score of 7.5 classifies this issue as High severity while the EPSS score of <1% indicates a low probability of exploitation. The flaw is a CWE-617 Improper Input Validation weakness. Attackers would need to deliver a malformed CEPH_MSG_MON_MAP, which in practice requires compromising or controlling a Ceph monitor or otherwise injecting messages into the client’s monitor communication channel. The CVE is not included in CISA’s KEV catalog, and the attack surface is limited to trusted or locally reachable monitors, making exploitation relatively constrained.