The vulnerability arises when a Ceph client reader attempts to read a file that it no longer holds the FILE_RD capability for, while its local state still indicates that the capability is wanted. Because the client updates its wanted capability flag before notifying the Metadata Server (MDS), a stale flag can cause the client to wait forever on a condition variable. This results in a denial‑of‑service condition where the client process hangs indefinitely, consuming system resources and potentially blocking other operations that rely on the same inode or network traffic.

The issue is confined to Linux kernel builds that provide a Ceph client implementation. All kernel versions before the application of the fix commit remain vulnerable, regardless of distribution or patch level, as the code paths for cap handling are identical in those releases.

The vulnerability is a local denial‑of‑service that requires an attacker to trigger a capability revocation in the presence of concurrent Ceph clients. There is no remote code execution or privilege escalation directly tied to the defect; the likelihood of exploitation is low to moderate, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is not available, so the exploit probability cannot be precisely quantified. However, because the defect involves an internal race condition, an attacker would need control over at least one Ceph client session or the ability to perform conflicting filesystem operations against the same file. Once triggered, the client hangs until unrelated cap traffic wakes it, making it a classic unbounded wait leading to resource exhaustion in the affected process.