The driver for the mvpp2 network interface incorrectly returns a receive buffer to the hardware buffer manager after that buffer has already been passed to XDP processing or attached to an skb. Because the kernel no longer owns the buffer at this point, the hardware may DMA into memory that has been freed or repurposed, resulting in kernel memory corruption or leakage of sensitive data. This flaw allows an attacker to corrupt the integrity of protected memory and potentially read or overwrite critical data in the kernel space.

All Linux kernel installations that ship with the mvpp2 driver before the patch are affected. The original CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. No explicit version range is listed, so any kernel that includes the pre‑patch mvpp2 driver is vulnerable until the firmware or kernel is upgraded to a release that contains the fix introduced in the commit 02e1b5c4d3b4c658b72c145427cded1bba613fc1 and the subsequent associated patches.

The vulnerability can be triggered by crafted network traffic that forces the driver to hand a receive buffer to the XDP or skb paths. Once a packet follows that path, a race can occur between buffer reuse and DMA, producing a window where the hardware writes to unowned memory. No EPSS value is available and the vulnerability is not currently listed in the CISA KEV catalog, but the kernel‑level nature of the bug and the potential for arbitrary memory corruption indicate a high severity if exploited. The attack is likely remote, requiring network access to the affected interface, and could lead to arbitrary code execution if an attacker successfully corrupts kernel memory.