The Linux kernel’s 3com 3c59x network driver contains a null pointer dereference in the vortex_probe1() function. When the pdev argument is null, free_ring() is called and the kernel crashes. The immediate effect is a kernel panic, leading to a service interruption and requiring a reboot to recover. The flaw is identified as CWE‑476.

The vulnerability applies to Linux kernel releases from 4.17 onward, including all 6.19 release candidates up to rc8. Systems that load the 3c59x driver module—typically those using 3com network adapters—are potentially impacted. Administrators should confirm that the 3c59x module is present and determine the exact kernel version in use.

The CVSS score of 5.5 indicates medium severity. The EPSS score is less than 1 %, suggesting a low historical probability of exploitation. The flaw is not listed in CISA’s KEV catalog, implying no confirmed active exploitation. Based on the description, it is inferred that an attacker would need local or privileged access to trigger driver initialization, as the fault occurs when the driver is loaded. Remote exploitation without elevated privileges is unlikely.