The vulnerability resides in the NVMe PCI driver of the Linux kernel. When peer‑to‑peer memory is used, the driver allocates dma_vec structures for scatter‑list DMA but fails to release them on completion. This leak causes kernel memory to grow unchecked, eventually exhausting available memory and leading to system instability or crashes. The weakness is a classic missing release of a resource after use, identified as CWE‑772.

All Linux systems running the standard Linux kernel with the nvme‑pci driver that do not yet incorporate the patch are affected. No specific kernel release is listed, so any kernel built with the NVMe driver before the change may be vulnerable. The affected product is the Linux kernel, as indicated by the CPE string.

The CVSS score of 7.5 reflects a significant availability impact. The EPSS score of less than 1% suggests that exploitation opportunities are rare, likely with the attacker needing to generate sustained NVMe traffic to trigger the leak. The vulnerability is not listed in the CISA KEV catalog. If an attacker can trigger repeated NVMe operations—locally or remotely with sufficient privileges—the kernel can be driven into memory exhaustion, causing denial of service on the affected host.