The vulnerability is a classic use‑after‑free in the Linux NVMe driver. It occurs when a namespace resolves a stale reference to the controller’s admin request_queue after the controller has been torn down. An attacker or corrupted user space process that can trigger the stale reference can read or corrupt kernel memory, potentially resulting in a system crash or an escalation of privileges.

The flaw exists in the Linux kernel NVMe driver across all kernel versions that have not incorporated the commit that moves the controller 'put' operation after all controller references are released. The patch is present in the latest kernel releases from the commit series referenced in the advisory (e.g., latest 6.13 series and later). Linux distributions that ship older kernel packages are therefore affected.

The CVSS base score of 5.5 suggests moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The flaw is a local kernel bug that requires an attacker to interact with the NVMe subsystem; it is not listed in the CISA KEV catalog. In practice, the risk to production systems is limited unless the attacker can trigger the bad path, for example by sending crafted NVMe commands or by manipulating the controller lifecycle. Systems running unpatched kernels should prioritize a kernel upgrade to remove the use‑after‑free potential.