The Linux kernel's rbd driver improperly handles error paths when device_add_disk() fails after device_add() has succeeded. The error handling calls rbd_free_disk() twice due to inconsistent teardown ordering, which can cause blk-mq cleanup to operate on invalid state and trigger a null pointer dereference in __blk_mq_free_map_and_rqs(). This vulnerability was identified via an experimental kernel memory-management analysis tool. The fix involves calling device_del() before rbd_dev_device_release() to maintain consistent teardown order and prevent re-entry into disk cleanup through an incorrect path.

This vulnerability can cause a kernel null pointer dereference leading to a denial of service (system crash). There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity), reflecting local attack vector with low privileges required and no user interaction needed.

A patch is available and should be applied by updating to the fixed Linux kernel versions as provided by the vendor. After updating, a system reboot is required to apply the changes. No additional mitigation steps are indicated by the vendor advisory.