An in‑kernel driver bug in the Intel IDPF network interface causes a NULL pointer dereference during hard reset, leading to a kernel panic and system restart. The fault arises because the driver detaches and closes netdevs while a reset is underway and fails to correctly recover the netdev state, exposing the device to callbacks after a failure. This is a classic NULL pointer dereference flaw (CWE‑476) and results in a denial of service by crashing the kernel. The vulnerability manifests when an attacker or a misconfigured script triggers a hardware reset on an active interface, either via sysfs or ethtool.

The affected kernel releases are Linux kernel 6.19 release candidates 1 through 4, and any other 6.19 builds that include the idpf driver. All Linux distributions shipping these kernels on machines with Intel Ethernet devices such as esn801f0 are impacted. This includes all vendors that ship the kernel upstream without integrating the patch.

With a CVSS score of 5.5 the issue is of medium severity and the EPSS score of less than 1% indicates that exploitation is unlikely, however it is not listed in the CISA KEV catalog. The attack vector requires local privileged access to issue a hard reset on the network device – for example, writing to /sys/class/net/*/reset or using ethtool – and can be triggered by scripts that simultaneously request hard and soft resets. An attacker with these capabilities could force a kernel panic, resulting in a denial of service. While the realistic likelihood is low, the impact is significant enough that a timely patch is recommended.