The vulnerability resides in the Linux kernel's nvmet subsystem, specifically within the pci-epf driver. The host controls the length of an SGL segment; when a non‑zero length that is shorter than the size of a single descriptor is reported, the driver sets the descriptor count to zero and then incorrectly reads the type byte from the byte immediately before the allocated buffer. This out‑of‑bounds read is reproduced as a KASAN slab‑out‑of‑bounds error that triggers a kernel panic. The fault can therefore be used to crash the system and potentially expose memory contents, but the description does not indicate that arbitrary code execution is possible.

Any Linux kernel that has not yet integrated the nvmet‑pci‑epf fix is potentially vulnerable. The CVE does not list specific version numbers, so all kernels running the nvmet subsystem before the patch should be considered at risk.

The CVSS score of 6.2 reflects a medium severity rating, and the EPSS score of less than 1% indicates a very low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. An attacker would almost certainly need local or privileged access to the NVMe subsystem to supply a malformed SGL, or would need to compromise a component that can relay such SGLs to the target. While the fault does not provide direct code execution, it can lead to a denial of service by forcing a kernel panic. Consequently, the risk is moderate but remains significant for systems that rely on nvmet.