The bnxt_en network driver processes asynchronous event completions generated by a Network Interface Card’s firmware. Within the async event completion handler for DBG_BUF_PRODUCER, a 16‑bit "type" field supplied by the firmware is used directly as an index into the kernel array bp->bs_trace[] without any bounds checking. The field can contain any value from 0 to 65535, so an attacker can cause the kernel to write beyond the array boundary, leading to kernel heap corruption or a system crash. The vulnerability does not provide a documented path to arbitrary code execution; it results only in memory corruption or a denial‑of‑service event.

The issue stems from the bnxt_en driver shipped in the Linux kernel. Any kernel kernel version that included the vulnerable driver before the bounds‑check fix is affected. The specific kernel releases are not enumerated in the CVE data; however, all versions of the Linux kernel that ship the unpatched bnxt_en driver are at risk.

The CVSS score of 7.1 signals high severity while the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack requires a NIC capable of writing arbitrary DMA completion data to host memory—i.e., a malicious or compromised firmware. An attacker would supply an out‑of‑range "type" value to trigger the kernel memory corruption or crash. A direct route to arbitrary code execution is not documented in the CVE data.