During the initialization of a Broadcom NetXtreme Ethernet device, an error path frees hardware resources and sets a DMA pool pointer to NULL. The subsequent de‑registration of the PTP clock triggers the driver's enable callback to clear PTP events, which then attempts to allocate from the freed DMA pool. The dereference of the now‑NULL pointer causes a kernel crash.

Linux kernel drivers for Broadcom NetXtreme cards (bnxt_en), affecting systems running kernel versions prior to the fix committed in 6.19‑rc3. The vulnerability applies to any platform that loads this driver and encounters an initialization error.

The CVSS score is not provided, but the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog. A local or privileged attacker who can force the device to initialize (e.g., after attaching a new network interface) could trigger the crash. It is inferred that the attack vector requires kernel access, likely local privileged execution, and the impact is a denial of service via kernel panic. The low EPSS suggests rare exploitability under normal conditions.