The flaw originates in the Linux kernel's idpf driver, which manages Intel Data Plane Frontend devices. During driver initialization, an error in the init_task routine can leave essential structures such as vports and netdevs uninitialized. When the driver subsequently attempts to use these resources during a reset, the kernel dereferences a NULL pointer, causing a crash. This results in a system-wide denial of service and can allow local users to disrupt critical services.

The issue affects the Linux kernel editions listed in the Common Platform Enumeration strings: mainly interim 6.19 release candidates (rc1 through rc8) and kernel 6.7. All builds that include the unmodified idpf driver are vulnerable until the patch that introduces proper error handling is applied.

With a CVSS base score of 5.5, the CVE represents moderate severity. The EPSS score indicates a negligible probability of automated exploitation (<1 %). The vulnerability is not published in the CISA KEV catalog, and the current attack vector appears localized, as an attacker would need the ability to load or reload the idpf driver on a target system. If the embedded system cannot be updated immediately, the risk remains until the driver is patched or disabled.