The vulnerability is a NULL pointer dereference that occurs when adding a network interface under a link aggregation group in the ocelot driver. When the driver attempts to access an unused port that is represented as a NULL pointer, the kernel crashes, causing a system reboot or loss of connectivity, which is effectively a denial of service for the affected system. The weakness is classified as CWE‑476.

Affected systems are Linux kernel installations that include the ocelot network driver, specifically the ocelot_vsc7514.c frontend. The vulnerability applies to all Linux kernel versions covered by the provided CPEs – including the 6.19 release candidates 1 through 4. The felix_vsc9959.c frontend, which employs the DSA framework and registers all ports, is not affected.

The official CVSS score is 5.5, indicating medium severity, and the EPSS score is below 1%, suggesting low exploitable probability at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local privileged user who can configure network interfaces, as the crash is triggered during the addition of an interface under a lag. There are no known publicly available exploit tools at the time of analysis.