The vulnerability is an out-of-bounds write in the nvmet_auth_challenge() function of the Linux kernel NVMe target implementation. The bug arises because the size of the challenge response is calculated using an untyped pointer, causing the program to write past the end of an allocated AUTH_RECEIVE buffer. The overflow can corrupt kernel memory, potentially leading to a kernel panic or arbitrary code execution. The impact is a loss of integrity and availability on the affected host.

Affected systems are Linux kernels that implement the NVMe target component (nvmet). No specific kernel version details are listed in the advisory, so all kernels that compile the unpatched code are potentially vulnerable.

The CVSS, EPSS, and KEV details are not provided, so the exact severity cannot be quantified. However, because the flaw resides in kernel code and overwrites a memory region that can trigger a kernel panic, the risk is high for systems that expose NVMe target services. Attackers likely need to initiate a malformed AUTH_RECEIVE transaction over a remote NVMe‑over‑TCP connection to trigger the overflow, which indicates a remote network attack vector.