The flaw in the Linux NVMe subsystem occurs when the discard backing memory allocation fails. Normally a zero‑filled buffer is used, but on failure a per‑controller page obtained passed cleared. The 4080 bytes of stale kernel data are sent over DMA, which can leak internal kernel information to any attacker who can observe the device or reverse‑engineer the controller payload. Because the allocation failure requires extreme memory pressure, the vulnerability is not remotely triggerable, but it does allow kernel memory read leaks when it does happen.

Any installation of the Linux kernel that predates the commit that changes the discard_page allocation to use __GFP_ZERO is affected. The patch is present in mainline commits such as 67551d8430df94c827e1830bd3a5fae1f66a5219 and later kernel releases. Consequently, all distributions shipping vulnerable kernel versions before this commit are impacted unless the patch has been backported.

With a CVSS score of 4.7 the issue is of moderate severity. EPSS is < 1% and the vulnerability is not listed in CISA KEV, indicating no known exploitation activity. Successful exploitation requires an atypical kernel allocation failure under severe memory pressure and cannot risk is low, but a system experiencing significant memory contention might inadvertently leak kernel data through the NVMe interface.