The Linux mvpp2 driver fails to refresh receive buffers before handing a descriptor to XDP or an sk_buff. If the driver’s refill routine returns a buffer that the NIC may DMA into after the kernel has passed control of the buffer away, the hardware can write to memory no longer owned by the kernel, leading to kernel memory corruption. This flaw is identified as CWE-416 (Use After Free) and CWE-763 (Buffer Underwrite).

Systems running the Linux kernel that include the mvpp2 network driver. The vulnerability affects kernels from the initial release up through Linux 7.1 release candidates RC 1‑RC 7, as indicated by the CPE entries. Any kernel version that has not yet applied the fixed commit is susceptible.

This flaw has a CVSS score of 9.8, classifying it as critical. The EPSS score is below 1 %, indicating a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attacker would need local access to the system and the target hardware must use the mvpp2 driver; however, the flaw could allow a kernel memory corruption that could lead to privilege escalation or arbitrary code execution. The likely attack vector is local, inferred from the description, and relies on the hardware DMA path being able to write to memory that the kernel no longer owns.