Linux Kernel EUVD-2026-45625

The attacker must have local shell access with at least low privileges (PR:L per CVSS) on a system running a Linux kernel between commit 492c5d455969fc2e829f26ed4c83487b068f0dd7 and the respective fix commits across the 6.12, 6.18, 7.0, and 7.1 stable series. The NVMe namespace character device (/dev/ng*) or another block device supporting user-space integrity metadata must be accessible to the attacking user - by default these devices are root-owned and not accessible to unprivileged users, meaning non-default permission configurations (e.g., udev rules or group membership granting access) are required unless the attacker already has root. The vulnerable code path is reached only through the bio-integrity user-mapping path, specifically when submitting I/O with integrity metadata attached. Remote exploitation is not possible; no network exposure exists.

The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately scopes this vulnerability: exploitation requires physical or remote shell access with low privileges, and impact is strictly a kernel crash - no data exfiltration or persistence. The EPSS score of 0.17% (6th percentile) signals negligible automated exploitation pressure, aligning with the local-only attack surface. There is no CISA KEV entry and no public exploit code has been identified. Even a mid-sized municipal IT team in sopot running NVMe-backed storage clusters should be able to address this through normal patch cycles rather than emergency change procedures, given the local access prerequisite and the narrow code path (NVMe passthrough with integrity metadata). The primary exposure scenario is shared multi-tenant systems - HPC clusters, database servers, or cloud hypervisors - where unprivileged users might have access to NVMe character devices (/dev/ng*); in such environments the Availability:High impact (kernel panic, forced reboot) is genuinely disruptive. The CVSS and EPSS signals are consistent and non-conflicting; no data discrepancies were observed.

A local attacker with a low-privilege shell on a multi-user Linux system (e.g., a shared HPC node or cloud VM with NVMe passthrough configured) opens the NVMe namespace character device and submits a passthrough command with a user-space integrity buffer crafted to trigger a partial-pinning return from pin_user_pages_fast(). The kernel proceeds to build bio vectors from the incompletely pinned page list, dereferences address 0, and faults with a general protection fault, crashing the system or triggering a kernel panic reboot. No public exploit code has been identified; the Kernel Oops included in the CVE description is a reproducer trace, not weaponized exploit tooling.