The Linux kernel’s nvmem module dispatches EEPROM data through a legacy onie‑tlv parser. When the parser encounters an entry type that it does not recognize, it fails to advance its internal offset and consequently falls into an infinite loop. This results in the driver, and ultimately the system, hanging because the loop consumes CPU time and stalls normal operation. The flaw is a classic infinite‑loop error classified as CWE‑835 and produces a local denial of service while the kernel remains loaded.

All Linux kernel builds that include the legacy onie‑tlv parser without the offset‑increment patch are affected, including stable releases and the 7.1 release candidates. The vulnerability is confined to devices that rely on nvmem to read EEPROM data, such as embedded routers, switches, and IoT gateways that employ the onie‑tlv layout.

The EPSS score is less than 1 %, indicating a very low exploitation probability. The CVSS score of 5.5 reflects moderate severity. The issue is not listed in CISA’s KEV catalog. The vulnerability is triggered only when a board’s EEPROM contains an unrecognized onie‑tlv entry type; the driver will then loop indefinitely until the system is rebooted or the board is updated. This represents a local denial of service that requires the presence of such an entry, and no evidence suggests that remote exploitation is feasible without first corrupting the EEPROM or firmware.