A flaw in the Linux kernel’s NVMe target component causes the request allocation routine to assign the peer‑to‑peer device pointer only after both data and metadata scatter‑list allocations succeed. If the data allocation succeeds while the metadata allocation fails, the cleanup path later attempts to free the device using an uninitialized pointer. This improper initialization can lead to kernel memory corruption or a crash, resulting in a denial‑of‑service condition.

All systems running a Linux kernel that includes the nvmet module and have not applied the commit that fixes nvmet_req_alloc_p2pmem_sgls() are regarded as vulnerable. It is inferred that, because specific kernel versions are not listed, any kernel lacking the fix should be considered vulnerable.

The CVSS score of 7.5 indicates a moderate to high severity. The EPSS score of less than 1% reflects a low likelihood of exploitation so far, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can trigger a metadata allocation failure in an NVMe target session. The flaw is limited to contexts where the NVMe target is active; exploitation would require a metadata allocation failure occurring after a successful data allocation, a scenario that can arise under heavy load or misconfiguration. The impact is primarily a kernel crash or denial of service rather than privilege escalation or data disclosure.