A vulnerability in the Linux kernel Ceph file system component allows unauthenticated attackers to trigger a high-CPU denial of service condition.

The vulnerability resides in the ceph_cap_reclaim_work function, which incorrectly re-queues itself when ceph_trim_dentries returns an EAGAIN status. This creates an unauthenticated, remotely triggerable busy loop that consumes system resources and prevents the kernel from making progress on other tasks.

Successful exploitation of this vulnerability results in a denial of service, as the kernel consumes excessive CPU resources to perform redundant, non-productive operations. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to system stability and availability, potentially disrupting critical business services that rely on the Ceph file system.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system performance metrics, specifically CPU utilization patterns, for unexplained spikes that persist over time, which may indicate a kernel-level loop.

Compensating Controls: Implement strict network access controls to restrict access to the underlying Ceph storage infrastructure, reducing the attack surface available to unauthorized actors.

Public Exploit Available: No (exploit_available: false)

Given the potential for significant resource exhaustion and service disruption, administrators should prioritize patching the Linux kernel to the identified secure versions. While there is no current evidence of active exploitation, the nature of kernel-level denial of service vulnerabilities necessitates a proactive and timely response to ensure environment stability.