A NULL dereference is triggered in the NVMe PCI driver when the driver’s DMA mapping requirements change during a data iterator loop. The driver incorrectly assumes that the dma_vecs array is always initialized, and when the flag dma_needs_unmap flips to true, the uninitialized array causes a memory access that can crash the kernel. The resulting kernel panic leads to a loss of availability for the affected system, potentially allowing an attacker to restart the machine or disrupt critical services. The flaw is a classic NULL pointer dereference that falls under CWE‑476.

All Linux kernel releases that include the NVMe PCI subsystem and that have not yet incorporated the patch that relocates the allocation of dma_vecs inside the iteration loop. The fix is referenced by the commit 071be3b0b6575d45be9df9c5b612f5882bfc5e88 in the Linux kernel source, and any system running a kernel version built from source prior to that commit is potentially vulnerable. No particular vendor or product version list is available beyond the generic Linux kernel family.

The CVE description does not state the attack vector. Based on the nature of the vulnerability—a null pointer dereference triggered when NVMe driver DMA mapping requirements change during data iteration—it is inferred that an attacker would need the ability to queue NVMe commands that cause iteration, which typically requires local privileged access. A non‑privileged user would normally need another privilege‑escalation path to affect the driver. The EPSS score is less than 1 %, and the flaw is not listed in the CISA KEV catalog. Any successful exploitation would produce a kernel panic, leading to a loss of system availability. The overall risk remains low to moderate depending on the host’s exposure.