In the Linux kernel’s macb network driver, statistics for active queues are copied using the maximum number of queues instead of the actual active number. This results in an out‑of‑bounds write into a vmalloc region, corrupting kernel memory. The flaw maps to CWE‑787 (Out‑Of‑Bounds Write) and, based on the description, could potentially lead to kernel crashes or provide a local privilege‑escalation vector if an attacker exploits the corruption.

The vulnerability is present in the macb driver bundled with the Linux kernel. All installations that load the unpatched macb module are potentially affected, regardless of the specific kernel release, because no CNA version exclusions were listed. Linux kernel distributions that include the macb code without the subsequent commit are at risk.

The EPSS score of <1% indicates a low probability of exploitation but does not preclude it. Based on the description, it is inferred that the flaw can be reached via the ethtool utility, a local command that authenticated users can run, potentially enabling a local attack vector. Based on the description, a successful exploitation would corrupt kernel memory, potentially enabling privilege escalation or denial‑of‑service. The CVSS score of 7.8 reflects a high severity. The vulnerability is not yet listed in CISA’s KEV catalog.