This vulnerability in the Linux kernel's nvmet-tcp subsystem, specifically nvmet_tcp_build_pdu_iovec, allows an attacker to cause the kernel to read beyond a submitted scatter‑gather list when a PDU length or offset exceeds the count of SG entries. The unchecked bounds lead to a kernel‑mode fault and may provide a path to arbitrary memory corruption. Because the components operate in privileged kernel space, exploitation can enable an attacker to elevate privileges or execute arbitrary code with system privileges.

The flaw is present in the Linux kernel starting with release candidate 6.19 rc1 through rc8, as indicated by the CPE list. The affected vendors are Linux:Linux. Systems running these kernels as part of a NVMe over TCP implementation are exposed. The commit that added proper bounds checks mitigates the issue, but all systems upstream from the bug remain vulnerable until the patch is applied.

The CVSS score of 9.8 marks the vulnerability as critical, and the EPSS score of less than 1% suggests that, as of the last analysis, exploitation activity is low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no publicly known exploits yet. The attack is likely network‑based, requiring the attacker to send malformed NVMe commands to a target exposing nvmet-tcp. The high severity mandates immediate action, even though the current exploitation probability remains modest.