The vulnerability resides in the Linux kernel’s nvmet-tcp subsystem. A helper function that sets up a PDU iterator returns void and silences callers when it sees an out‑of‑bounds PDU length or offset. Because callers do not detect the failure, they overwrite the command’s state and later use an uninitialized iterator to read network data. This flaw allows an attacker that can inject crafted network packets to corrupt kernel memory and feasibly execute arbitrary code with kernel privileges. It demonstrates improper initialization and incorrect error handling weaknesses (CWE‑665, CWE‑682).

The affected component is the Linux kernel. No specific version range is provided in the CVE data; the issue applies to any kernel that contains the nvmet-tcp implementation before the fix is applied. The vendor is Linux, product Linux Kernel.

A kernel‑level flaw that can be triggered over the network. Although no CVSS or EPSS score is available, the potential for arbitrary code execution and kernel memory corruption gives the vulnerability a high severity. The bug is not listed in the CISA KEV catalog, but it remains exploitable by attackers able to reach the nvmet‑tcp service. No known constraints are listed, so standard network-facing deployment of nvmet-tcp is the likely attack vector.