The Linux kernel’s NVMe Apple driver contained a flaw that allowed two queues—an admin queue and a normal IO queue—to use the same command tag on devices with the Apple A11 SoC. When a duplicate tag was detected, the firmware aborted with a "duplicate tag error for tag N" and crashed, effectively bringing the system down. This represents a classic race‑condition style failure (CWE‑795) where concurrent resources share identifiers and leads to a denial of service at the firmware level.

The vulnerability is confined to the nvme‑apple portion of the Linux kernel and affects any kernel release that incorporates that legacy driver without the recent patch. Devices running a Linux distribution on an Apple A11 SoC that have not updated to a kernel with the crash‑preventing change are potentially impacted. No specific distribution or kernel version is listed in the data, so any unpatched kernel is considered vulnerable.

Exploitation requires local interaction with the NVMe device; an attacker must send overlapping tag values to trigger the crash. The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 percent suggests a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the crash can be used to destabilize a host, and the workaround—reserving distinct tags for the admin queue—serves as a temporary mitigation until a kernel patch is applied.