The kernel NVMe target contains a flaw where the host identifier is only copied after controller allocation, causing all per‑namespace reservation reference entries to receive a nil UUID. The abort logic relies on this UUID to match the host performing a preempt or abort request; the nil value never matches, so abort or preempt operations silently fail, leaving a victim host’s in‑flight I/O in the system. This reduces reliability of the abort feature and can lead to data consistency issues and unrecovered I/O on storage clients. No immediate code execution or data exfiltration is possible, and the impact is limited to service degradation and potential integrity problems for NVMe workloads. The CVSS score is 5.9, indicating a medium severity vulnerability associated with CWE‑908.

All Linux kernel releases that contain the nvmet target code before the upstream patch commit (6202783…) are affected. The advisory lists the vendor as Linux and the product as Linux kernel, but no specific version numbers are provided. Consequently any kernel incorporating the buggy sequence of hostid copying before the controller is published is potentially vulnerable.

Based on the description, it is inferred that an attacker needs only normal client access to an NVMe namespace with reservation support enabled. The exploit does not require elevated privileges or special configuration, and it does not provide access to code execution or data exfiltration. EPSS data is < 1% and the vulnerability is not a CISA KEV item, indicating limited public awareness. The CVSS score is 5.9, and the described functional loss is an availability risk: preempt or abort requests report success while the victim’s I/O continues to process, which can lead to silent failures and data inconsistency.