The vulnerability arises in the libceph component of the Linux kernel, where a missing guard allows a NULL pointer dereference during CRUSH map traversal. When a parent bucket has a name present in the map but lacks a matching type entry, the lookup returns a null type name. The code then dereferences this null pointer and calls strcmp(), causing a kernel crash. This represents a classic denial‑of‑service condition that can be triggered by malformed hierarchy metadata.

Affected systems are Linux kernels that include the libceph module. The vulnerability does not specify particular releases, so any kernel version prior to the commit that introduced the guard is potentially vulnerable. This includes most distributions using the stock upstream kernel.

Because the flaw requires the presence of a malformed CRUSH map entry, an attacker would need to influence the Ceph filesystem configuration or otherwise supply malicious metadata. The attack surface is therefore limited to environments where the kernel has access to Ceph metadata that can be manipulated. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating that current exploitation is unlikely. The CVSS score is not provided in the available data. Nonetheless the crash nature warrants concern for affected deployments.