The vulnerability arises in the Linux kernel’s nvmet subsystem, specifically in the pci‑epf driver. The host can dictate the length of an SGL segment. When a non‑zero length shorter than a single descriptor is reported, the driver sets the descriptor count to zero and then incorrectly reads the type byte from the buffer’s preceding byte, outside its allocated range. This causes an out‑of‑bounds read and, in the reproduced test, triggered a KASAN panic and a kernel crash. An attacker controlling such an SGL can force a crash, leading to denial of service, and could potentially expose sensitive data through the read, although code execution is not directly described.

The affected component is the Linux kernel, and any Linux kernel distribution that has not incorporated the fix for the nvmet‑pci‑epf path is potentially vulnerable. The specific kernel versions impacted were not enumerated in the advisory. All kernels running nvmet before the patch should be considered at risk until the update is applied.

The CVSS metric is not specified, but the nature of the fault points to a severe impact, as a kernel panic can bring down a host and leak memory contents. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation yet. Attackers would most likely need local or privileged access to the NVMe subsystem to supply the malformed SGL, or exploit a remote component that forwards such SGLs to the target. Until mitigated, the risk remains high due to the potential to crash the system.