The flaw lies in the nvmet discovery subsystem of the Linux kernel, where the command that fetches a log page does not fully validate the offset supplied by the host. Only a basic dword alignment check is performed; the offset is added to a small buffer and then copied to a scatter‑gather list without ensuring the copy stays within the allocated heap. An unauthenticated client can therefore instruct the target to read bytes beyond the buffer, leaking kernel addresses and, if the offset points outside mapped memory, causing a kernel panic or crash. The immediate consequence is loss of confidentiality for kernel state and a denial‑of‑service by crashing the nvmet target.

All Linux kernel builds that contain the nvmet discovery feature and have not applied the patch referenced in the linked commit list are affected. No specific version range is enumerated, so any kernel—including the default packaging in most distributions—might be vulnerable until the fix is integrated.

The attack can be carried out over any traffic that can reach the nvmet target (TCP, RDMA, or Fibre Channel) and does not require prior authentication; the discovery subsystem allows all hosts by default. The attacker sends a Get Log Page request with a crafted offset and length to read kernel memory or crash the target. The CVSS score of 9.1 classifies the flaw as critical, reflecting the high potential impact. The EPSS score is below 1 % and the vulnerability is not currently listed in the CISA KEV catalog, indicating low observed exploit activity, but the potential impact of exposing kernel pointers or causing a crash warrants immediate remediation.