The ctxfi driver in the Linux kernel assumes that the function daio_device_index() always returns a valid index, but the function can fail. Because the driver does not check the return value, an invalid index may be used, which can cause kernel instability or an unexpected crash. The weakness is represented by CWE-252 (Unchecked Return Value).

The affected product is the Linux kernel. No specific kernel versions are enumerated in the CVE data, so any kernel that includes the ctxfi driver and has not yet incorporated the patch that introduces the error check may be vulnerable. The vendor is Linux.

The CVSS score of 7.0 indicates a high severity issue. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying that no known public exploit exists at this time. The most likely attack vector is a local kernel‑level interaction; an attacker would need to trigger a failure in daio_device_index() while the ctxfi driver is active. If exploited, the result could be a kernel crash leading to denial of service.