The NVMe PCI driver leaks DMA mappings when it fails to allocate a tracking descriptor during data setup for both PRP and SGL interfaces; existing unmap helpers cannot be used because they depend on successful allocation. Because the iterator remains mapped, the kernel memory is not released. The leak extends to situations where an invalid bio_vec is detected during PRP mapping, broadening conditions for the failure. The result is a gradual loss of DMA resources and kernel memory, potentially leading to system instability or a complete denial of service.

All Linux kernel builds that contain the nvme‑pci driver before the commit that adds explicit unmapping for failed descriptor allocation are affected. The vulnerability exists in the device initialization and data staging logic for NVMe devices that use PRP or SGL descriptors. No specific kernel release numbers are provided, so any build lacking the fix is susceptible.

The EPSS score of less than 1% indicates a low probability of exploitation. The CVSS score of 5.5 reflects moderate severity and the vulnerability is not listed in CISA's KEV catalog, implying no known active exploits. Exploitation would require the attacker to repeatedly trigger a data setup error, which typically demands privileged or kernel‑level privileges. Consequently, the immediate threat to untrusted users is minimal, although a privileged actor could cause resource exhaustion over time.