Within the Linux kernel's i40e network driver, a tracepoint assignment mistakenly uses get_cpu() without a subsequent put_cpu() call, causing the preempt_count to remain incremented. This preemption counter leak can disturb kernel scheduling logic, potentially leading to kernel instability or a localized denial of service if the counter remains erroneously high. The weakness is a code‑handling defect (CWE‑911) that allows an unintended persistence of a scheduling counter.

Any Linux kernel build that includes the i40e driver, encompassing most generic Linux distributions, may contain the vulnerable code. No specific kernel version range is provided, so systems running kernels with the unpatched i40e module are potentially impacted.

With a CVSS score of 5.5, the vulnerability is considered moderate in severity. The EPSS score is under 1 %, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require a process executing with kernel privileges, as the issue resides in driver code during poll tracing. Therefore the exploitability is limited to local privileged contexts and is not publicly exploitable from a remote surface. The official fix involves replacing get_cpu() with smp_processor_id(), eliminating the preemption counter leak.