In the Linux kernel, a flaw in the igc driver causes a page fault during a shutdown of an XDP application that had requested transmit timestamps. When the link remains up, stale XDP socket metadata is accessed by the interrupt handler, leading to a kernel panic and a system crash. The fault results in a denial of service, affecting the availability of the affected host, but does not directly compromise confidentiality or integrity.

The vulnerability affects Linux systems that use the igc network driver in the kernel. It is present on all kernel releases prior to the fix committed in the patch series referenced by the Advisory. The exact affected versions are not listed, so any Linux kernel that may still be running the old igc driver code is potentially vulnerable.

With a CVSS score of 7.0, the flaw is considered moderate to high severity. Because the bug requires local control of an XDP application or the ability to trigger a shutdown while the device link is up, the attack surface is limited to users with privileged access to the kernel or the network interface. No public exploit is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is unavailable, so the precise likelihood of exploitation is uncertain, but the impact remains significant for affected hosts.