The Linux kernel NVMe multipath driver incorrectly marks a namespace as zoned based solely on the command set identifier at allocation time. When a subsequent zone information query reports a zero zone size, the path namespace registers without zoned limits while the namespace head still advertises zoned capability with a size of zero, causing the kernel to perform a logarithmic shift by log base 2 of zero. This improper arithmetic can corrupt kernel memory or trigger a fault during zone reporting or write operations, leading to system instability or crash. The vulnerability is tied to CWE-1335.

The vulnerability resides in the Linux kernel NVMe multipath driver. The affected versions are those prior to the commit that introduced the fix references in the advisory, as the patch removes the zoned feature from the head allocation. No other product‑specific version ranges are listed.

The EPSS score of <1% indicates a very low exploitation probability, and the CVE is not listed in the CISA KEV catalog. The CVSS score of 4.1 indicates low severity. Based on the description, the likely attack vector is local on the host, where an attacker with access to the NVMe device or the ability to issue zone commands could provoke the fault and induce a denial of service. No known remote attack vector is described.