The ixgbevf driver for virtual network interfaces contains a missing .negotiate_features callback for Hyper‑V operation. When the driver is probed on a Hyper‑V virtual machine, the function pointer is NULL and the probe routine dereferences it, triggering a kernel BUG and a system crash. The vulnerability does not allow direct code execution or privilege escalation; the primary impact is a denial of service that can affect the entire host. The likely attack vector is local or during system boot: any process that causes the ixgbevf driver to load on a Hyper‑V VM, such as device enumeration or a malicious driver loading, would trigger the crash. This inference comes from the fact that the bug is uncovered during the probe stage. The crash occurs because the driver calls ixgbevf_set_features() unconditionally, expecting a valid .negotiate_features function. Without the function, the kernel dereferences a NULL pointer. The vulnerability is a classic NULL pointer dereference (CWE‑476).

Any Linux kernel running the ixgbevf driver on a Hyper‑V virtual machine before the commit a7075f501bd3 was applied is affected. The vulnerability is present in all kernel releases that lacked this patch; the fix is included in more recent kernels that incorporate the commit. Affected vendors: Linux (generic), typical Hyper‑V hosted virtual machines using the ixgbevf driver. Exact version ranges are not listed, but any kernel prior to the inclusion of the fix is vulnerable.

The CVSS score is not provided and the EPSS score is unavailable, but the presence of a NULL pointer dereference that leads to a kernel panic suggests high severity if the driver can be loaded. Since the exploit requires the driver to be probed on a Hyper‑V VM, it generally needs local or privileged process access to the virtual machine. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation, but the potential for denial of service remains significant.