While processing a Ceph MDS reply, the kernel stores a Ceph request pointer in the task's journal_info field. During direct reclaim, the ext4 filesystem's JBD2 layer misinterprets this pointer as a journal handle and dereferences it, resulting in a kernel crash. The crash aborts the kernel, causing a denial of service that affects all running processes.

Linux kernel implementations that use the Ceph protocol layer and the ext4 filesystem may be vulnerable. The vulnerability applies to any kernel version that contains the pre‑fix code path for handling Ceph replies in handle_reply() and does not yet incorporate the patch adding a scoped NOFS allocation. No specific version range is supplied, so all kernel releases before the applied fix are at risk.

Data for CVSS and EPSS are not provided, but the bug leads directly to a kernel panic, a high‑severity effect. Because the trigger is a crafted Ceph reply, an attacker with network access to a Ceph cluster can request a page over which the kernel will crash, making the likelihood of exploitation moderate to high in environments where Ceph traffic is exposed to untrusted users. The vulnerability is not listed in the CISA KEV catalog, and no publicly known exploits have been reported. However, the impact remains severe due to the complete loss of kernel functionality on an affected node.