A NULL pointer dereference vulnerability in the Linux kernel NVMe target (nvmet) driver can be exploited by an unauthenticated attacker to trigger a system crash (denial of service).

The vulnerability exists in the nvmet_execute_identify_ns_zns function, which incorrectly attempts to access a NULL pointer when processing an Identify command targeting a file-backed namespace. Because the I/O command set is routed to this function regardless of the namespace backing type when ZNS is enabled, an unauthenticated host can trigger a kernel panic.

Successful exploitation of this vulnerability results in a denial of service, causing the affected system to crash or become unresponsive. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to system availability, particularly for infrastructure relying on NVMe-over-Fabrics deployments. Unplanned downtime in these environments can disrupt dependent services and lead to operational instability.

Immediate Action: Update the Linux kernel to version 5.15.221, 6.1.188, 6.6.157, 6.12.110, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages associated with nvmet or NVMe command processing.

Compensating Controls: If patching is delayed, restrict access to the NVMe target interface to trusted hosts only via network-level access control lists (ACLs) or firewalls.

Public Exploit Available: Unknown

This vulnerability represents a significant stability risk for systems utilizing the NVMe target driver. Administrators should prioritize the application of kernel updates as soon as they become available through their respective distribution channels. Ensuring the kernel is patched to the specified versions is the only definitive way to prevent potential denial-of-service attacks against the storage subsystem.