A Ceph monmap that advertises zero monitors is incorrectly treated as valid by the Linux kernel’s libceph. When the client receives such a map it triggers a BUG_ON in the session‑opening path, causing the Ceph client to crash. The result is an immediate denial of service for any Ceph client that relies on the kernel’s Ceph stack.

All Linux kernel distributions that include the Ceph client library are potentially affected. The flaw resides in libceph’s CEPH_MSG_MON_MAP processing, so any kernel compiled with Ceph support and not yet upgraded contains the issue. Version numbers are not specified, meaning all current releases lacking the patch are at risk.

The EPSS score is not available, suggesting a low probability of public exploitation. The vulnerability requires an attacker to control or compromise a Ceph monitor that sends a malformed monmap with a monitor count of zero. Since the failure occurs after establishing a connection to the monitor, the attack surface is limited to trusted monitors or local‑network exposed monitors. The CVE is not listed in CISA’s KEV catalog, but an unpatched client could crash when it receives the invalid monmap.