A race condition exists in the nvmet module of the Linux kernel where the nvmet_bio_done() function can be executed after a request has been re‑queued, leading to a NULL pointer dereference in blk_cgroup_bio_start(). This vulnerability triggers a kernel panic and system crash, disrupting availability. The weakness is a NULL pointer dereference (CWE‑476) and does not directly enable code execution but can be exploited to cause denial of service if an attacker can influence NVMe target requests.

Affected kernel releases include Linux 6.16 from release candidate 5 through 7 and Linux 6.19 from release candidate 1 through 7. Any kernel built from these branches that has not incorporated the nvmet_bio_done reordering fix remains vulnerable. Earlier nightly builds and the generic kernel before the patch are also affected.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% suggests a very low probability of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to manipulate NVMe traffic that targets the system’s NVMe over Fabrics subsystem. Because the flaw leads to a crash rather than code execution, the probable impact is denial of service rather than privilege escalation.