An invalid free in the Linux kernel’s NVMe Fibre‑Channel (nvmet‑fc) implementation can cause the kernel to release a pointer that precedes an allocated object. The bug is triggered when the LS IOD array is unwound after a request‑buffer or DMA‑mapping failure, leading to a KASAN‑reported invalid‑free. If exploited, the kernel may crash or be manipulated to corrupt memory, which can be leveraged for privilege escalation or denial of service.

The vulnerability resides in the nvmet‑fc component of the Linux kernel and is present in all kernel releases that contain the unpatched code path. The patch is included in the mainline kernel after the commits referenced in the advisory. The specific affected versions are not listed in the data; thus any kernel version prior to the applied fix is at risk.

There is no public EPSS score and the vulnerability is not listed in the CISA KEV catalog, indicating a low or unconfirmed exploitation probability. The exact attack vector is not disclosed, but the flaw appears to be exploitable from a local or network context where NVMe‑FC requests can be manipulated, such as an attacker with control over NVMe‑FC target configuration. Because the bug leads to a memory corruption on the kernel side, it remains a high‑impact condition should an attacker succeed in triggering the error path.