The vulnerability arises when firmware populates MAC address, link modes, and EEPROM data in a shared structure that the kernel accesses via the MAC block. If a system boots without a MAC block, the kernel attempts to read this data, leading to an internal fault and a kernel panic. The result is a denial of service that completely halts the affected system. The weakness is a missing validation of firmware data prior to access, which aligns with a null pointer dereference type failure.

The issue is present in the Linux kernel for versions 6.19‑rc1 through 6.19‑rc6, particularly on hardware that uses the OcteonTX interface such as the Marvell OcteonTX CN98XX board. Any Linux installation that boots this board without an initialized MAC block is susceptible.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, further suggesting it is not widely known or actively exploited. Based on the description, the likely attack vector is local physical access at boot time, where an attacker can trigger the kernel crash by deactivating or omitting the MAC block during system initialization. Exploitation requires no network connectivity and is confined to the affected system itself.