The vulnerability stems from an underflow in bounds checks when parsing the ANA (Asymmetric Namespace Access) log within the nvme-multipath driver. The kernel subtracts the announced size of an untrusted object before verifying that the object fits within the remaining buffer; if the announced size exceeds the buffer, the subtraction underflows, causing the parser to read beyond the allocated memory. This out‑of‑bounds read can leak kernel memory contents, thereby compromising system confidentiality and potentially enabling privilege escalation if the attacker can influence subsequent operations. The weakness is characteristic of out‑of‑bounds reads (CWE‑787) and improper input validation (CWE‑20).

Any Linux kernel image that includes the nvme-multipath driver compiled in is potentially affected, regardless of the kernel release name. Because the vulnerability is tied to the handling of ANA logs, systems that use NVMe storage and have the nvme-multipath module enabled are the only ones that expose the vulnerable code path. Specific kernel versions are not enumerated in the CVE data, so all builds shipped before the fix identifier are presumed vulnerable.

No CVSS or EPSS score is provided, and the issue is not listed in the CISA KEV catalog, indicating that no publicly announced exploitation or widespread monitoring data exist. The bug requires an attacker who can supply a malformed ANA log to the kernel, meaning the attacker must control the NVMe device or have a route to inject data into the driver. While the lack of exploits suggests a lower probability, the potential for kernel data leakage warrants precautionary action.