The ixgbevf driver for virtual network interfaces contains a missing .negotiate_features callback for Hyper‑V operation. When the driver is probed on a Hyper‑V virtual machine, the function pointer is NULL and the probe routine dereferences it, triggering a kernel BUG and a system crash. The vulnerability does not allow direct code execution or privilege escalation; the primary impact is a denial of service that can affect the entire host. The likely attack vector is local or during system boot: any process that causes the ixgbevf driver to load on a Hyper‑V VM, such as device enumeration or a malicious driver loading, would trigger the crash. This inference comes from the fact that the bug is uncovered during the probe stage. The crash occurs because the driver calls ixgbevf_set_features() unconditionally, expecting a valid .negotiate_features function. Without the function, the kernel dereferences a NULL pointer. This vulnerability is a classic NULL pointer dereference and is also categorized under CWE‑476 and CWE‑824.

Any Linux kernel running the ixgbevf driver on a Hyper‑V virtual machine before the commit a7075f501bd3 was applied is affected. The vulnerability is present in all kernel releases that lacked this patch; the fix is included in more recent kernels that incorporate the commit. Affected vendors: Linux (generic), typical Hyper‑V hosted virtual machines using the ixgbevf driver. Exact version ranges are not listed, but any kernel prior to the inclusion of the fix is vulnerable.

The CVSS score is 5.5 (moderate severity). The EPSS score is <1%, indicating a low exploitation probability. This indicates that while the bug can cause a denial of service via kernel crash, the likelihood of exploitation is currently low and it is not listed in the CISA KEV catalog. The attack requires the driver to be probed on a Hyper‑V VM, generally requiring local or privileged process access to the virtual machine.