The ocelot driver contained a race condition because ocelot_port_xmit_inj() called ocelot_can_inject() and ocelot_port_inject_frame() without acquiring the injection group lock. These functions enforce a lockdep assertion that the lock should be held. The missing lock protection can lead to concurrent access to shared kernel state, potentially corrupting memory or causing a kernel crash, which translates into a denial of service.

All Linux kernel releases that contain the ocelot network driver before the patch that adds lock protection around the registration injection path are affected. The issue is tied to the ocelot driver implementation used in kernel versions prior to the inclusion of the missing lock fix.

The CVSS score of 5.5 indicates a Medium severity, while the EPSS score is <1%, showing an extremely low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating that widespread exploitation has not been observed. However, because the flaw involves a race condition in kernel space, the potential impact is severe when an attacker can influence network traffic directed to the affected driver. The likely attack vector is a local or remote attacker who can generate traffic processed by the ocelot driver to trigger the race, causing a kernel crash or data corruption.