The Linux kernel’s NVMe PCI driver contains a race condition (CWE‑367) in which a user‑initiated change to the polled queue count during a reset can trigger a high‑priority task to poll the queue before the block layer updates the queue maps. This timing gap may cause the same I/O request to be completed twice, potentially leading to unexpected kernel behavior. The vulnerability does not explicitly enumerate the consequences of double completions, but the duplication of completion events could disrupt normal I/O flow and destabilize the driver.

All Linux kernel releases that include the nvme‑pci driver before the polled‑queue patch is applied, including the 7.0 release candidates. The issue is present in the mainline kernel where the driver was vulnerable.

The vulnerability is scored with a CVSS score of 4.7, indicating moderate risk. The EPSS score of less than 1 % reflects very low exploitation likelihood. Because the flaw requires modifying driver parameters that are typically privileged, the attack vector is local rather than remote. The flaw is not present in the CISA KEV catalog.