A fault in the Linux kernel’s stmmac driver for the GMAC4 network interface causes the kernel to crash when the split‑header option is enabled. The driver incorrectly assumes that the second buffer of the first receive descriptor is fully populated; if the hardware fails to fill it, the driver uses an invalid length value to compute the size of the next descriptor. This miscalculation results in a kernel paging request and an oops, ultimately bringing the system down.

All Linux kernel builds that include the GMAC4 stmmac driver with the split‑header feature enabled are affected. No specific kernel version numbers are listed; any kernel that ships with this driver and has split‑header enabled could be vulnerable.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. The likely attack vector is the delivery of specially crafted packets to the GMAC4 interface, which would trigger the driver’s path that leads to the crash. The description implies that the impact is limited to a denial of service via kernel panic, with no mention of code execution or data exfiltration.