The kernel lacked a check that the actual number of bytes received in an NVMe TCP read matches the requested length. As a result a controller could return a short payload, such as 512 bytes for a requested 4096-byte read, and the kernel would still mark the request as complete. The user space process would then receive a full buffer filled with data that was already on the page, exposing potentially sensitive information that was not part of the intended read.

Linux kernel versions that include the nvme_tcp driver are affected. The flaw exists in all supported Linux kernel releases that have not yet applied the upstream commit that adds a byte-count check on NVMe TCP read completions.

The CVSS score of 7.4 indicates a moderate to high severity. The EPSS score indicates a very low exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation yet. Based on the description, it is inferred that attacking this weakness would require control over the NVMe controller or the ability to force the controller to respond with truncated data, which typically implies either a compromised controller or the ability for a malicious actor to read incorrect or leaked data from memory buffers exposed by the kernel.