The vulnerability is an out‑of‑bounds array access in the NVMe PCI driver. During device initialization the driver uses the hctx->numa_node value to index the dev->descriptor_pools array. On a non‑NUMA kernel the value is NUMA_NO_NODE (-1); because the variable is declared unsigned it overflows to UINT_MAX, causing the index to exceed the array bounds. This produces a page fault during namespace allocation, leading to a kernel crash and leaving the NVMe namespace without a /dev node. The flaw is an out‑of‑bounds array index caused by unsigned conversion of a negative value.

All Linux kernels that include the NVMe PCI driver prior to the commit that changes the numa_node parameter type to int and adds bounds checking are affected. The issue appears on kernels built without NUMA support (CONFIG_NUMA=n) that still load the NVMe driver. Any distribution that uses such a kernel will encounter the crash when an NVMe controller is probed, regardless of vendor.

The CVSS score of 8.4 indicates high severity, while the EPSS score of < 1 % shows that the flaw is unlikely to be actively exploited at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to trigger namespace allocation by probing an NVMe device, which is a local activity. The likely attack vector is local privilege but the description only confirms a local crash; no remote exploitation path is described. The low exploitation probability suggests a measured approach, yet the high impact warrants immediate remediation.