The vulnerability is a race condition in the Linux kernel's NVMe/TCP implementation that allows an attacker to trigger a double reference count decrement on a target queue. An NVMe/TCP host can send an initialization request (ICReq) and close the connection before the target processes the message, causing the queue state to be overwritten and a second kref_put to execute on an already released queue. This defect in error handling (CWE-1341) can lead to a use‑after‑free or kernel crash, resulting in denial of service.

Affected systems are Linux kernel installations that include the nvmet‑tcp subsystem. The vulnerability exists in all kernel versions prior to the patch that serializes queue state changes and prevents double teardown. No specific version range is supplied, so any Linux kernel that implements nvmet‑tcp without this fix is affected. The flaw was addressed by the commit identified in the references.

The CVSS score is 9.8 and the EPSS score is < 1%.; the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the potential for a kernel crash and its exploit vector over a network connection to the NVMe/TCP service make the risk high for systems exposed to untrusted hosts. An attacker would need to influence a client that connects to the target over NVMe/TCP, but does not require local privileges. While no exploit has been reported, the conditions for exploitation are within reach of a sophisticated adversary.