The vulnerability resides in the Linux kernel networking driver, where the PHY‑centric SFP cage probing routine is mistakenly invoked while using genphy drivers. Because the probe runs under the RTNL locking mechanism, this incorrect path causes the kernel to deadlock on the RTNL lock. When the deadlock occurs, the network stack stalls and the system becomes unresponsive, effectively producing a denial of service. The weakness is a concurrency error described by CWE‑758.

All Linux kernels that include the genphy code path for PHY drivers and are built without the patch commit 5a0082ec20a05ef2378410323a5089a8f1786f4a are vulnerable. Any distribution shipping an unpatched kernel prior to that commit is impacted, regardless of the distribution version number.

The CVSS score of 5.5 classifies the flaw as moderately severe. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited real‑world abuse. Based on the description, it is inferred that an attacker would need local or privileged access to the network subsystem to trigger the deadlock, such as by reconfiguring or reloading network drivers, although this is not explicitly stated. The likely attack vector would therefore involve local or privileged actions rather than remote exploitation.