In the Linux kernel’s NVMe‑FC loopback implementation, a callback intended to free a response structure is only set when the remote port is online. When the remote port is offline, the structure is freed by an alternate path, which can lead to improper resource cleanup. This improper resource management may cause memory leaks or kernel crashes, threatening system availability. Based on the description, it is inferred that an attacker could trigger this flaw by sending crafted NVMe‑FC loopback requests that cause remote port state changes, resulting in delayed or duplicated cleanup operations.

The flaw is confined to the Linux kernel’s NVMe‑FC subsystem, specifically the nvmet‑fcloop component. All installations running a kernel version prior to the mitigate commit are vulnerable. The fixed code resides in the NVMe‑FC loopback handling routine and is incorporated into the latest stable kernel releases.

The CVSS score of 5.5 classifies the issue as moderate severity, while an EPSS score below 1% and absence from CISA’s KEV catalog indicate a low exploitation likelihood. Based on the description, it is inferred that the attack vector most likely requires local privilege or the ability to send crafted NVMe‑FC loopback requests. This suggests remote exploitation is unlikely, but the potential denial‑of‑service impact warrants timely patching.