The kernel block subsystem allows cloned block requests that carry integrity data to reuse a cached integrity segment count from the source request. If that count is lower than what the underlying low‑level queue actually requires, an internal assertion triggers a BUG_ON, causing a kernel crash. The flaw does not leak data or alter state beyond the crash; it merely disrupts service when a block I/O path encounters the inconsistency, representing a contract gap between stacked drivers and queue settings.

All Linux kernel builds that employ stacked block drivers with integrity support, in particular configurations such as dm‑multipath fanning into nvme‑rdma. No specific version numbers are listed, so any kernel deployment that uses these drivers may be impacted if the underlying queue constraints differ from the top queue.

The EPSS score is below 1%, indicating a very low likelihood of widespread exploitation at the time of this analysis. The CVSS score of 9.8 indicates critical severity. The vulnerability is not in the CISA KEV catalog. The impact is severe—any request that triggers the BUG_ON will crash the kernel and cause system‑wide denial of service. The likely attack vector is local: an attacker with permissions to perform raw block I/O or influence device requests can trigger the failing path. Despite the low external exploitation probability, the damage per successful exploit is total service interruption.