A use‑after‑free occurs in the NVMe PCI driver when the function that frees host memory does not clear the pointer after freeing the non‑contiguous buffer. This allows a second free to dereference a stale pointer, producing a NULL pointer dereference in the I/O memory management code and causing a kernel panic. The flaw is a classic use‑after‑free weakness (CWE‑476). The impact is a local denial‑of‑service through a kernel crash.

Any system running a Linux kernel that loads the NVMe driver can be affected. The issue can surface on Thunderbolt‑attached NVMe devices such as the OWC Envoy Express behind a Dell WD22TB4 dock or on similar setups where the device intermittently returns I/O errors during host memory block (HMB) setup. No specific kernel version is listed, so all kernels before the patch are potentially vulnerable.

The CVSS score of 7.0 marks it as high severity, but the EPSS score of less than 1% indicates a low probability of widespread exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to present a Thunderbolt NVMe device that can trigger the HMB allocation routine, causing an I/O error during probe. This can be achieved with physical access to the host or through a malicious device that induces the error path. Successfully exploiting the flaw results in a kernel panic, effectively denying service to all users of the affected machine.