The bug originates from an out‑of‑bounds array index in the NVMe PCI driver’s nvme_dbbuf_set routine. When the loop counter exceeds the number of online queues, the code reads or writes beyond the end of a slab allocation, causing a kernel memory corruption. This defect was detected by KASAN and leads to reads or writes outside allocated bounds. An attacker who can trigger the fault might cause a kernel panic or corrupt critical data structures.

The vulnerability is present in the Linux kernel’s NVMe host/pci module. All kernel builds that contain the unpatched nvme_dbbuf_set function are affected. The exact version range is not specified; any kernel prior to the commit that applied this fix is vulnerable. Vendors affected include all distributions shipping such kernels.

The absence of a published exploit and the unavailability of an EPSS score make real‑world exploitation probability uncertain, but the potential impact of a successful attack is severe because of kernel memory corruption. The issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be local, requiring interaction with an NVMe controller to trigger the fault.