The vulnerability arises from an out‑of‑bounds array index in the NVMe PCI driver’s nvme_dbbuf_set function. When the loop counter used to iterate over online queues exceeds the valid range, the code accesses memory beyond the allocated slab. This out‑of‑bounds read or write can corrupt kernel memory and may result in a kernel panic or system instability. The defect was identified by KASAN and is proven to cause memory corruption when the fault occurs.

All Linux kernel builds that include the unpatched nvme_dbbuf_set implementation are affected. The fix was applied in a commit that modifies the loop condition to bound the index within dev->online_queues – 1, excluding the admin queue. Because no specific version range is supplied, any kernel prior to the commit cited in the advisory remains vulnerable. Any distribution shipping such kernels, regardless of distribution or kernel version, can be impacted.

The CVSS score of 7.1 indicates a high severity risk. No public exploit has been reported and the EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The issue is not in CISA’s KEV catalog. The attack vector is inferred to be local; an attacker would need physical or administrative access to an NVMe controller to trigger the fault and potentially exploit the kernel memory corruption.