A null‑pointer dereference in the Linux MVPP2 network driver occurs when the driver attempts to switch buffer pools during operations such as changing the MTU beyond the jumbo frame limit, because the code does not check that the CM3 SRAM base pointer is valid. This missing guard allows the driver to read from address zero, which triggers a kernel panic and brings the system down, disabling all kernel services and causing a denial of service.

Linux kernels that include the MVPP2 driver, such as kernel 5.12 and the 7.0 release candidates prior to the inclusion of the patch that adds the CM3 SRAM device tree entry and the global_tx_fc guard. Systems running Marvell Ethernet devices that rely on the MVPP2 packet processor are the most likely to be affected.

The flaw is locally exploitable by an attacker with sufficient privileges to trigger a buffer‑switching event—such as changing the MTU. It does not provide a remote code execution path. The CVSS score of 5.5 reflects moderate severity, the EPSS score of <1% indicates a low likelihood of real-world exploitation, and the vulnerability is not listed in CISA's KEV catalog. Nonetheless, any local attacker who can influence network configuration can crash the system, rendering services unavailable.