The vulnerability is a NULL pointer dereference in the nvmet_tcp_build_pdu_iovec function of the Linux kernel. When an invalid or prematurely sent H2C_DATA PDU is processed, the kernel dereferences uninitialized pointers and can trigger a kernel panic. The impact is a loss of availability; an attacker could force the host to crash and require a reboot.

Affected systems are all Linux kernel instances that implement NVMe over TCP before the fix was introduced. The kernel CPE list shows that the flaw exists in the 6.19 release candidates (rc1 to rc5) and, by implication, in the corresponding stable releases that incorporate that code path. Any system with the kernel prior to the commit that brought the bounds checking and pointer validation is vulnerable.

The CVSS score is 7.5, indicating high severity, while the EPSS score of less than 1% suggests exploitation is currently considered rare. The vulnerability is not listed in the CISA KEV catalog, so no known mass exploitation campaigns have been recorded yet. Attackers could trigger the fault by sending specially crafted H2C_DATA PDUs before establishing a CONNECT handshake or by targeting READ or uninitialized command slots. Because the protocol operates over the network, the attack vector is likely remote, allowing an external host to disrupt the target.