The kernel block subsystem allows cloned block requests that carry integrity data to reuse a cached integrity segment count from the source request. If that count is lower than what the underlying low‑level queue actually requires, an internal assertion triggers a BUG_ON, causing a kernel crash. This flaw arises from improper maintenance of internal state (CWE‑667), where the cached integrity segment count is not recomputed for the actual underlying queue. The bug does not leak data or alter state beyond the crash; it merely disrupts service when a block I/O path encounters the inconsistency, representing a contract gap between stacked drivers and queue settings.

All Linux kernel builds that employ stacked block drivers with integrity support, in particular configurations such as dm‑multipath fanning into nvme‑rdma. No specific version numbers are listed, so any kernel deployment that uses these drivers may be impacted if the underlying queue constraints differ from the top queue.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of < 1% shows a very low likelihood of widespread exploitation at the time of this analysis. The vulnerability is not in the CISA KEV catalog. The bug corresponds to CWE‑667, Improper Maintenance of State, and results in a kernel panic when mapping integrity segments for a cloned request. The likely attack vector is local: an attacker with the ability to influence or perform raw block I/O can trigger the failing path. Though exploitation is unlikely in the wild, any successful trigger leads to a system‑wide denial of service.