Linux kernel contains a bug in the nvmet-tcp module that can be triggered when a data digest mismatch occurs. During the error path, a request that has previously failed to initialize is unconditionally uninitialized, causing a reference count underflow. This leads to a warning in the reference switching code, a diagnostic that indicates a use‑after‑free, and ultimately a permanent workqueue deadlock that can make the host unresponsive. The weakness is a classic use‑after‑free scenario where a kernel reference counter is decremented without being properly initialized.

Linux kernel users implementing NVMe‑over‑TCP clients or servers are affected. The vulnerability applies to any kernel build that includes the nvmet‑tcp implementation, as indicated by the CPE reference for any Linux kernel version.

The vulnerability is a local or network-based denial of service; the attacker would need to supply a crafted NVMe request that triggers the digest mismatch. Exact exploitation conditions are inferred from the code context: a client that can send malformed data to the host. The exploit is not known to be publicly available, and the EPSS score is <1%. The KEV status indicates the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 9.8, and the permanent deadlock indicates a high impact should the flaw be abused.