pmem_submit_bio records a preflush error yet still copies bio data, subsequently overwriting that error with a successful flush. This allows data writes to occur after a failed preflush, enabling the bio to succeed despite the missing ordering guarantee. The effect is that persistent memory writes may be performed out of order, creating a risk of data loss or corruption.

Linux kernels that include the nvdimm/pmem subsystem without the recent commit that enforces synchronous preflush handling are affected. Any distribution running an unpatched kernel version that uses persistent memory devices is at risk.

The CVSS score of 5.5 denotes moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires privileged kernel or escalated access and manipulation of pmem flush operations; it is therefore an insider or compromised admin scenario rather than a remote, automated exploit.