The Linux kernel nvme-pci driver contains logic that leaks DMA mappings when it fails to allocate a tracking descriptor during data setup for both PRP and SGL interfaces. If an allocation failure occurs, the iterator remains mapped and cannot be unsealed with the standard helper, resulting in a memory and DMA resource leak. Additionally, the driver leaks mappings when it detects an invalid bio_vec during PRP mapping, broadening the conditions under which the flaw manifests. This leak can accumulate over time and cause kernel memory or DMA resource exhaustion, leading to system instability or a denial of service.

All Linux kernel builds that include the nvme-pci driver before the commit that adds explicit unmapping for failed descriptor allocation are affected. Known affected Release Candidates include Linux kernel 7.1 RC1, RC2, RC3, and RC4. Any other build lacking the fix is also susceptible.

The EPSS score of <1% suggests that exploitation is rare, and the CVSS score of 5.5 indicates moderate severity. This vulnerability is not listed in CISA's KEV catalog, implying no known active exploits. Based on the description, it is inferred that an attacker would need to repeatedly trigger a data setup error in the nvme‑pci driver, which typically requires privileged or kernel‑level access. Consequently, the immediate threat to untrusted users is minimal, although a privileged actor could cause resource exhaustion over time.