A defect in the NVMe driver of the Linux kernel causes a local bio pointer to be leaked when an integrity mapping fails. The bio structure, which may contain kernel data, is inadvertently exposed through the unchanged NULL local bio reference, potentially exposing sensitive kernel information to local processes. This flaw does not allow arbitrary code execution but can leak confidential kernel information.

The vulnerability affects all Linux kernel builds that include the NVMe driver prior to the patch. No specific version matrix is supplied; any kernel level that implements the NVMe mapping functionality is therefore potentially impacted.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of less than 1% implies a very low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local execution within the kernel environment, requiring the attacker to trigger a mapping failure in the NVMe subsystem. No remote or network-based exploitation path is described, so the risk remains constrained to privileged local users.