In the Linux kernel’s bnxt_en network driver, firmware responses provide a type value that is stored in a context structure and later used as an index into internal arrays such as ctx_arr[] and bnxt_bstore_to_trace[]. When the firmware supplies a type outside the valid range, the driver can index beyond the allocated bounds of these arrays, leading to kernel memory corruption. This flaw represents CWE‑823, Improper Validation or Sanitization, and could potentially allow an attacker to overwrite kernel memory or crash the system. Based on the description, it is inferred that an attacker could trigger kernel memory corruption or system crash by providing an out‑of‑range type value.

The vulnerability resides in the bnxt_en driver that ships with all Linux kernel releases containing the affected code. The CPE list references kernel 7.0 release candidates through 7.0 rc6, but the patch commit appears in earlier stable releases as well, meaning any kernel that has not yet incorporated the fix—across distributions and custom builds—is at risk.

The CVSS score of 5.5 denotes moderate severity, while the EPSS score of less than 1 % indicates a very low observed exploitation probability. The flaw is not listed in the CISA KEV catalog. Attacking this vulnerability would require influencing firmware responses, a condition that normally necessitates local or privileged access. The likely attack vector is the ability to manipulate firmware responses, which typically requires local or privileged access. Based on the EPSS score, it is inferred that exploitation attempts are unlikely at this time. Without publicly available exploits, the current risk remains moderate pending further evidence.