In the Linux kernel, the mvpp2 network driver mistakenly refills receive buffers after a descriptor has already been handed to XDP or an skb. The driver may return a buffer that the kernel no longer owns to the hardware buffer manager, allowing the hardware to DMA into memory that is not owned by the kernel and potentially corrupting kernel memory.

All Linux kernel releases that contain the mvpp2 driver but were built before the upstream commit that introduced the safe refill logic are vulnerable. Distribution packages compiled from those kernels contain the defect. Using any kernel version that includes the upstream commit, or a later release, resolves the issue.

The CVSS score of 9.8 indicates a high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no active exploits are reported. Exploitation would require sending crafted network traffic that triggers the incorrect buffer reuse path, but the description does not indicate any known exploitation.