An attacker who can control a remotely sent NVMe command can specify an enormous SGL length, causing the kernel to attempt to allocate an unrealistically large scatter‑list. The allocation request exceeds the maximum page order and triggers a WARN_ON_ONCE_GFP warning; if the system is configured to panic on warnings, this will bring the kernel down. The underlying weakness is uncontrolled resource allocation by untrusted input, identified as CWE-770.

The flaw exists in the Linux kernel nvmet-tcp subsystem and affects all kernel releases prior to the inclusion of the fix; the vendor is Linux. No specific version range is listed in the CNA data, so any kernel build preceding the patch commit represents a vulnerable system.

The CVSS score is not disclosed, and EPSS is not available, but the vulnerability can lead to a kernel panic if panic-on-warn is enabled, representing a high‑risk denial‑of‑service scenario. The attacker requires the ability to send NVMe commands to the target, which is typically possible from a remote initiator. The vulnerability is not listed in CISA’s KEV catalogue, but its exploitability is straightforward for an attacker with remote NVMe access.