The net/mana driver in the Linux kernel constructs per‑device debugfs directories using a hard‑coded name for physical functions and the return value of pci_slot_name(pdev->slot) for virtual functions. When pdev->slot is NULL, typical in VFIO passthrough or nested KVM settings, pci_slot_name dereferences a NULL pointer – a classic flaw identified as CWE-476: NULL Pointer Dereference. The resulting kernel Oops causes a denial of service by crashing the kernel. Additionally, using the string "0" for all physical functions leads to duplicate directory names; virtual functions from different PCI domains can also produce identical slot names, which causes debugfs_create_dir() to return –EEXIST and prevents directory creation. Both pathologies disrupt normal kernel operation.

Linux kernel versions that contain the net/mana network driver before the commit that changes debugfs directory naming are affected. This includes any kernel built with the default net/mana driver in configurations such as the standard Linux distribution kernels. No specific version range is documented; hence any system running a kernel that includes the pre‑commit net/mana code is at risk.

The flaw is local; an attacker must be able to trigger driver initialization or re‑load the module on a system that has the vulnerable net/mana driver. By generating hot‑plug events, rebooting the machine, or disabling and re‑enabling the driver, a local user can provoke a kernel crash or block debugfs entry creation. The CVSS score of 5.5 and an EPSS score below 1% indicate moderate severity with a low likelihood of exploitation in common environments. The vulnerability is not listed in the CISA KEV catalog.