The vulnerability is an out‑of‑bounds write in the nvmet_auth_challenge() function of the Linux kernel NVMe target. A mistakenly calculated buffer size causes data to be written beyond the end of an allocated AUTH_RECEIVE buffer. This overwrite can corrupt kernel memory, potentially triggering a kernel panic or resulting in a denial of service. The weakness is identified as an improper bounds check (CWE‑787).

Affected systems are Linux kernels that contain the NVMe target component (nvmet). The advisory does not list specific kernel versions, so any kernel that compiles the unpatched nvmet_auth_challenge code is potentially vulnerable. The vendor name is Linux and the product is the Linux kernel.

The CVSS score of 7.5 classifies the flaw as High severity. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a remote attacker sending a malformed AUTH_RECEIVE packet to an NVMe‑over‑TCP target; this inference is drawn from the involvement of the NVMe target and the network stack in the backtrace. Exploitation would lead to memory corruption and could cause a kernel panic or service interruption.