In the Linux kernel’s ec_bhf ethernet driver, the function dma_free_coherent() mistakenly uses the allocation length as the DMA handle during an error path, instead of the correct physical address. This mismatch can cause an incorrect unmapping of a buffer that was previously coherently mapped, potentially corrupting kernel memory. The CVE description does not explicitly state privilege escalation, but such corruption could allow an attacker to affect system integrity if they can trigger the error condition. The weakness is identified as an improper resource cleanup related to DMA usage (CWE‑628).

Any system running the Linux kernel with the ec_bhf Ethernet driver is susceptible. The CNA data does not specify affected kernel versions, so all deployments of this driver should be considered at risk until the patch is applied.

The CVSS score of 8.8 denotes high severity, yet the EPSS score of less than 1% reflects a low predicted exploitation probability at this time. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known or confirmed exploits. The likely attack vector is an attempted network condition that forces the driver into the error path, inferred from the nature of the DMA handling exposed by the bug. While exploitation would require the attacker to induce the error, the potential for kernel memory corruption warrants careful monitoring.