The vulnerability resides in the Linux kernel NVMe over Fabrics driver. A timing issue between cancel_work_sync and nvme_fc_delete_association causes the I/O error work queue to be scheduled after the associated work has been cancelled, leading to list_del corruption and an immediate kernel Oops. This crash can potentially allow an attacker to force a system reboot or freeze, compromising availability. The weakness is catalogued as CWE-1341.

All Linux operating systems that include the NVMe over Fabrics driver in the kernel are affected. The issue was identified in kernel 6.12.0 before the patch was merged. Any system using a kernel version prior to the official fix, regardless of vendor distribution, may be impacted if the problematic driver is present.

The CVSS score of 6.6 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation. An attacker would need the ability to induce an I/O error on an NVMe FC device; this could be achieved by local privileged access or possibly through a remote device that can send malformed commands, though the exact attack vector is not explicitly detailed in the advisory. Based on the information, the risk is moderate, but the exploitability is low to moderate depending on environment exposure.