The flaw allows a constructed C2HData packet to be processed when the request operator is WRITE_ZEROES and the system has a leftover iterator from a previous command on the same tag. Because the kernel submodule reads the payload size without verifying segment counts, the data are copied into memory that no longer belongs to the current request, producing a wild memory access that triggers a kernel panic via KASAN. This results in a crash that can be leveraged to deny service to users on the affected host.

All Linux kernel builds that include the nvme-tcp subsystem and records the data length in the private request structure; the vulnerability exists in any kernel revision prior to the commit identified by the reference committer hash "25e5cb780e62". The affected vendors are the Linux Community and any distribution that ships the unpatched kernel.

With a CVSS score of 5.9 the vulnerability is considered moderate. No publicly available exploitation code is known, and the EPSS score is less than 1%, indicating a very low probability of exploitation, but the issue is not listed in the CISA KEV catalog. An attacker who can send crafted NVMe-over-TCP packets to a target—either from a connected network or by compromising that network—could trigger the crash. The lack of an access control restriction beyond the network interface implies the attack vector is network-based, and the vulnerability can be exploited unless mitigated by patching or disabling the protocol.