A memory leak vulnerability in the Linux kernel nvme-pci driver allows remote attackers to cause a denial of service through resource exhaustion.

This is a resource management error in the nvme-pci driver where dma_vec allocations for peer-to-peer memory are leaked on completion, requiring no user authentication or interaction to trigger.

A successful exploit of this vulnerability can lead to severe system instability and resource exhaustion, resulting in kernel panics or complete system crashes. This creates significant business downtime for affected infrastructure. The assigned CVSS score of 7.5 reflects a high severity due to the potential for a complete denial of service against vulnerable systems.

Immediate Action: Update the Linux kernel to version 7.0.11 or later, or apply the upstream fix commits provided by the vendor.

Proactive Monitoring: Monitor system memory usage and kernel logs for abnormal consumption patterns or driver-related errors indicating resource leaks.

Compensating Controls: Restrict network access to vulnerable endpoints using firewalls or security groups to minimize exposure until patches can be applied.

Public Exploit Available: No

Administrators managing systems running the affected Linux kernel versions must prioritize applying the latest stable kernel updates. Immediate patching is essential to prevent potential denial of service conditions and maintain overall system availability.