In the Linux kernel nvmet‑tcp subsystem, the function nvmet_tcp_build_pdu_iovec lacks bounds checking for the scatter‑gather list when a PDU length or offset exceeds the number of SG entries. This allows an attacker to cause the kernel to read beyond the intended buffer, which can trigger a kernel‑mode fault and surface as a KASAN error. The exploit does not inherently provide a pathway for arbitrary code execution but can cause a denial of service by crashing the system.

The vulnerability affects Linux kernels that expose the nvmet‑tcp service, specifically starting with release candidate 6.19 rc1 through rc8 as listed in the CPE entries. All systems running a kernel version within that range that have nvmet‑tcp enabled for NVMe over TCP are potentially impacted.

The likely attack vector is remote network access that involves sending crafted NVMe over TCP commands to a target running nvmet‑tcp. Based on the description, it is inferred that an attacker would need to send a PDU whose length or offset exceeds the available scatter‑gather entries to trigger the out‑of‑bounds read and generate a KASAN error. The impact is a denial of service caused by a kernel crash. With a CVSS score of 9.8 the flaw is rated critical, but the EPSS score of less than 1% indicates a low probability of active exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, meaning no public exploits are known. Despite the low observed exploitation likelihood, the high severity warrants prompt mitigation.