The Linux kernel NVMe driver contains an inefficient loop that removes stale namespaces by iterating over every 32‑bit namespace ID (NSID) in each gap between reported namespaces. When an NVMe controller has a sparse NSID space, this loop can run billions of times, consuming CPU cycles and causing the system to soft‑lockup. The resulting kernel stall prevents normal operation, effectively denying service to all processes that rely on the affected device.

All Linux installations running a kernel that includes the buggy nvme_scan_ns_list code are affected, regardless of distribution or vendor. The vulnerability is not tied to a specific vendor’s kernel patch set; any kernel older than the fix that introduces the open NSID‑range removal algorithm is susceptible. Specific affected kernel versions are not documented.

The CVSS score is 7.5, indicating high impact severity. EPSS score is 0.00603, suggesting a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with local control over an NVMe device can supply a deliberately sparse NSID range to trigger the excessive loop. The likely attack vector involves presenting or tampering with an NVMe controller connected to the target. The bug can cause resource exhaustion and a kernel soft lockup, which is a denial‑of‑service that affects the entire system.