The defect in the Linux kernel’s libie subsystem causes the fwlog deinitialization routine to access an uninitialized variable when firmware logging was never enabled. When the ixgbe driver is unloaded, such as during a system fallback or recovery mode, the kernel encounters an oops and may reboot, resulting in a loss of availability on the affected machine.

Any Linux kernel containing the buggy libie_fwlog_deinit logic is potentially affected; all distributions that have not yet applied the recent fix are at risk. Processes that load or unload the ixgbe network driver during recovery or other maintenance operations can trigger the crash. No specific kernel release range is provided, so all current kernels that include this code until the patch is applied remain vulnerable.

With a CVSS score of 5.5 the severity is moderate, and an EPSS score below 1% indicates a very low probability of being exploited in the wild. Exploitation requires local privileged access to unload a driver or to boot into a recovery environment; there is no remote attack surface. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at present.