In the Linux kernel’s NVMe‑FC loopback implementation, a callback intended to free a response structure is only set when the remote port is online. When the remote port is offline, the structure is freed by an alternate path, which can lead to improper resource cleanup. This improper resource management may cause memory leaks or kernel crashes, threatening system availability.

The flaw is confined to the Linux kernel’s NVMe‑FC subsystem, specifically the nvmet‑fcloop component. All installations running a kernel version prior to the mitigate commit are vulnerable. The fixed code resides in the NVMe‑FC loopback handling routine and is incorporated into the latest stable kernel releases.

The CVSS score of 3.3 classifies the issue as moderate severity, while an EPSS score below 1% and absence from CISA’s KEV catalog indicate a low exploitation likelihood. The vulnerability requires interaction with the NVMe‑FC loopback path, which typically implies local privilege or the ability to send crafted NVMe-FC requests, making remote exploitation unlikely. Nonetheless, the potential denial‑of‑service impact warrants timely patching.