In the Linux kernel's airoha network driver, a null pointer dereference occurs when the cleanup routine is called after a failed DMA descriptor or queue entry allocation. The fault happens because the driver initializes a descriptor count variable too early, so the cleanup code mistakenly detects the queue as initialized and attempts to delete a NAPI object that was never added. The result is a kernel panic that brings the system down. Additionally, moving the page pool allocation after the descriptor list allocation prevents memory leaks when descriptor allocation fails.

All systems running a Linux kernel that includes the airoha network driver, regardless of specific version, are affected. The vulnerability is tied to the driver’s initialization logic and cleanup handling.

EPSS information is unavailable and the issue is not listed in the CISA KEV catalog, so publicly documented exploitation data is limited. The vulnerability requires access to the airoha device and sufficient privileges to trigger driver initialization failures, implying a local or privileged-level attack vector. While the CVSS score is not supplied, the potential for a denial‑of‑service crash makes it a high‑impact bug in kernels where the flawed driver is present.