The Linux kernel’s NVMe target module contains a use‑after‑free bug in nvmet_pci_epf_exec_iod_work. When a command that does not transfer data from the device to the host completes asynchronously, the I/O object can be freed before the function reads its length and direction fields, resulting in a KFENCE‑reported read of freed memory. This kernel memory corruption can cause a crash or, if the attacker controls the freed memory contents, enable arbitrary code execution in kernel mode. The flaw is confined to the kernel; user‑space programs are not directly involved.

Linux kernel releases that include the buggy NVMe target code before the fix, which includes all mainstream distributions running a non‑patched kernel. The advisory references commits such as 1ed1eeaef55cebf2d74b3ef104c20bdab719b165, which merged the fix into mainline. Consequently, any host running an affected kernel with the nvmet target enabled is at risk.

No public exploit has been reported, and the EPSS score is not available while the vulnerability is not listed in KEV. The lack of a safeguard means a determined attacker with the ability to craft NVMe commands could trigger this use‑after‑free. The potential impact is a kernel crash or privilege escalation, so the vulnerability carries high risk. The likely attack vector is remote, via the NVMe over Fabrics interface to an exposed nvmet service.