The vulnerability involves an out‑of‑bounds access in the bnxt_en driver’s async event handler. A firmware supplied 16‑bit type value is used as an index into a kernel heap array without bounds checking. An attacker controlling the NIC can supply any value from 0 to 65535, which leads to a read/write outside the valid array bounds and corrupts kernel memory or causes a crash. This can allow the adversary to gain arbitrary kernel‑level code execution or denial of service.

The flaw is present in the Linux kernel, affecting all Linux distributions that include the vulnerable bnxt_en driver in the kernel. No specific kernel version is listed as affected in the bulletin, so any installation of the kernel that has not applied this patch is potentially vulnerable.

The CVSS score is not provided, but out‑of‑bounds memory corruption in the kernel is typically considered a severe vulnerability. The likelihood of exploitation requires an attacker to control the NIC’s firmware or send crafted packets that cause the firmware to write a malicious type value. If successful, the flaw can lead to kernel crash or arbitrary code execution. The issue is not listed in the CISA KEV catalog, and the EPSS score is unavailable, so the exact exploitation probability is unclear, but the high potential impact warrants immediate remediation.