The Linux kernel’s nvmet subsystem contains a bug in the nvmet_pci_epf_create_cq routine. When a Create IO CQ command from a remote PCI host fails to map the PCI address space, the function falls through error paths without releasing the reference to the completion queue and its controller. Each failed attempt therefore leaks kernel resources.

All Linux kernel releases that have not yet incorporated the commit fixing nvmet_pci_epf_create_cq are affected. The flaw is specific to the NVMe over Fabrics PCI e‑PCI interface; any system that processes Create IO CQ requests from external PCI devices may see the impact.

Although the vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, the leak can be triggered repeatedly by a remote PCI host that requests Create IO CQ commands. Repeated failures could exhaust kernel memory or reference counters, interrupting normal operation and yielding a denial of service on an exposed NVMe subsystem. Because the problem arises from a reference count mismatch, attack preparation requires only the ability to send malformed or failing commands to the target.