An attacker who can control a remotely sent NVMe command can specify an enormous SGL length, causing the kernel to allocate more pages than allowed. The allocation failure triggers a WARN_ON_ONCE_GFP warning; if the system is set to panic on warnings, the kernel will crash. The underlying weakness is uncontrolled resource allocation by untrusted input, identified as CWE-1285.

The flaw exists in the Linux kernel nvmet‑tcp subsystem and affects all kernel releases prior to the inclusion of the fix; the vendor is Linux. No specific version range is listed in the CNA data, so any kernel build preceding the patch commit represents a vulnerable system.

The CVSS score is 6.2 and the EPSS score is <1%, indicating a moderate severity and very low exploitation probability for a kernel panic if panic-on-warn is enabled. The attacker requires the ability to send NVMe commands to the target, which is typically possible from a remote initiator. The vulnerability is not listed in CISA’s KEV catalogue, but its exploitability is straightforward for an attacker with remote NVMe access.