The kernel bug causes the admin queue allocated during a controller reset to be orphaned instead of properly released, resulting in a resource leak. The resulting unreleased memory can accumulate, degrading system performance or leading to a denial of service. This vulnerability is categorized under CWE-772, reflecting improper resource management.

The flaw affects all Linux kernel implementations that use the NVMe driver prior to the introduction of the fix. The specific kernel version ranges are not enumerated in the available data, but any kernel build lacking the patch is vulnerable.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying it is not widely exploited in the wild. Exploitation would likely require local access or elevated privileges that enable interaction with NVMe controller reset commands. The attack vector, inferred from the description, would involve a privileged user resetting the NVMe controller and triggering the leak, potentially leading to resource exhaustion over time.