The vulnerability in the Linux kernel's nvmet-tcp module arises from calling nvmet_req_uninit() without verifying if nvmet_req_init() succeeded. When a data digest mismatch occurs in nvmet_tcp_try_recv_ddgst(), nvmet_req_uninit() is called unconditionally. However, if the command failed initialization via nvmet_tcp_handle_req_failure(), the reference count was never incremented, causing a refcount underflow when nvmet_req_uninit() decrements it. This underflow triggers a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and can lead to a permanent deadlock in the workqueue. The fix involves checking the NVMET_TCP_F_INIT_FAILED flag before calling nvmet_req_uninit(), preventing the underflow and subsequent issues.

The vulnerability can cause a reference count underflow leading to kernel warnings, use-after-free diagnostics, and ultimately a permanent deadlock in the kernel's workqueue. This impacts system stability and availability, potentially causing denial of service. Confidentiality and integrity impacts are rated high in the CVSS vector, indicating potential for serious compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a code fix involves adding a check for the INIT_FAILED flag before calling nvmet_req_uninit(). Until an official patch or vendor advisory is available, users should monitor for updates from the Linux kernel maintainers and apply patches promptly once released.