In the Linux kernel, the libwx subsystem contains a code path that reads the PF‑restricted register WX_CFG_PORT_ST during virtual function (VF) initialization. Because the kernel does not verify that the caller is a VF, the read triggers an illegal register access that causes the kernel to hang. The flaw, an illegal register access (CWE‑1220), results in a complete system lockup, effectively denying service to all processes. No confidential data is exposed by the failure, so the impact is limited to availability.

Linux kernels 6.18 (including rc5, rc6, and rc7) and 7.1 rc1 through rc2 contain the vulnerable libwx code. Subsequent releases that have not yet applied the patch may also be affected, but no other versions are listed in the current data.

The EPSS score is under 1 %, indicating a low probability of wild exploitation. The CVSS base score of 5.5 reflects moderate severity, with no impact on confidentiality or integrity. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability requires privileged local access to configure a VF; an attacker with such permissions could trigger the system hang, delivering a local denial of service. Because creating VFs typically requires administrative or kernel‑level privileges, the attack vector is most likely local.