A null pointer dereference in the kernel can be triggered by a remote NVMe/TCP client when it sends a CONNECT command for an I/O queue that carries a bogus or stale control identifier. The fault causes the kernel to panic, resulting in an unauthenticated remote denial of service. This weakness is a classic Null Pointer Dereference (CWE‑476).

The vulnerability applies to systems running FreeBSD that expose an NVMe/TCP target. No specific version range is listed in the advisory, so any FreeBSD installation configured with NVMe/TCP support may be affected until a patch is applied.

With a CVSS score of 7.5 the risk is considered moderate to high, yet the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker merely needs network access to the NVMe/TCP target and can trigger the failure without authentication, making the attack vector network-based and straightforward once the target is reachable.