In the Linux kernel, the nvmet‑tcp subsystem contains a use‑after‑free condition that is triggered when a data digest mismatch occurs during an R2T‑based transfer that is not the final packet. The digest error handler incorrectly frees the command’s reference without marking it completed, allowing a second free when the queue is torn down. This double free can corrupt kernel memory, potentially causing a kernel crash or, if the memory corruption can be controlled, arbitrary code execution. The vulnerability is identified as CWE‑1341, a use‑after‑free flaw.

The bug affects all Linux kernel versions shipped before the patch that eliminates the double free. Any distribution that uses the nvmet‑tcp driver with data digest enabled on NVMe/TCP connections is susceptible. Although the CNA vendor list contains only "Linux", the issue is a generic kernel flaw that applies to all affected kernel releases.

The CVSS score of 9.8 indicates a high level of severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploit at present. An attacker would need the ability to send crafted NVMe/TCP packets with a mismatched data digest, which requires privileged network access or compromise of a device that uses data digest. If such an attacker can inject the wrong digest, they could trigger the double free and cause a kernel crash.