While processing a Ceph MDS reply, the kernel stores a Ceph request pointer in the task's journal_info field. During direct reclaim, the ext4 filesystem's JBD2 layer misinterprets this pointer as a journal handle and dereferences it, resulting in a kernel crash. The crash aborts the kernel, causing a denial of service that affects all running processes.

Linux kernel implementations that use the Ceph protocol layer and the ext4 filesystem may be vulnerable. The vulnerability applies to any kernel version that contains the pre‑fix code path for handling Ceph replies in handle_reply() and does not yet incorporate the patch adding a scoped NOFS allocation. No specific version range is supplied, so all kernel releases before the applied fix are at risk.

The CVSS score of 9.8 indicates a critical level of severity for this kernel crash. The EPSS score of < 1% indicates a very low exploitation probability, suggesting low exploitation risk in environments where Ceph traffic is exposed to untrusted users. The vulnerability is not listed in CISA's KEV catalog, and no publicly known exploits have been reported. Nonetheless, the impact remains severe due to complete loss of kernel functionality on an affected node.