The vulnerability lies in the NVMe target module nvmet of the Linux kernel, where the function nvmet_sq_create() increments a controller reference count with kref_get_unless_zero() but fails to release it when nvmet_check_sqid() rejects an invalid queue ID, resulting in a reference count leak. Over time, repeated failures can consume kernel memory, degrade system stability, or trigger a denial‑of‑service. The flaw is classified under CWE‑911 and carries a CVSS score of 5.5, indicating a medium severity conflict.

Any Linux kernel installation that has not yet incorporated commits 26355295, 34b9a83, and fcef60ed to nvmet is affected. This includes all distributions shipping a kernel older than those commits regardless of vendor. Users running an unpatched kernel expose the NVMe target subsystem to the risk.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. An attacker would need local or privileged access that allows interaction with the NVMe target to repeatedly trigger the failing queue‑creation path and accelerate the leak. While the likelihood of exploitation is low in the wild, the potential impact is the gradual exhaustion of kernel memory leading to service disruption.