The vulnerability occurs in the Linux kernel’s MANA network driver. When queue allocation fails during attachment, the cleanup path improperly frees and NULLs the tx_qp and rxqs structures. Subsequent teardown or error paths dereference these pointers without performing NULL checks, causing a kernel panic. This results in the entire operating system, leading to a denial of service. The issue involves a NULL pointer dereference (CWE-476).

Linux kernel installations that include the net:mana driver. The issue affects all kernel releases prior to the commit that added NULL guards. It is not limited to a specific distribution but applies across all distributions shipping the affected kernel version.

The CVSS severity is moderate due to the ability to trigger a kernel panic. The EPSS score is less than 1%, indicating a relatively low probability of widespread exploitation at this time, but the flaw is listed as NOT in the CISA KEV catalog. Exploitation would likely require an attacker to trigger an allocation failure on the target machine, possibly by sending crafted traffic to the MANA interface. Once the failure occurs, the lack of NULL checks enables an attacker to cause a system crash with no additionally required privileges. Based on the description, it is inferred that the likely attack vector is local or remote network-based, depending on whether the victim can influence the MANA driver’s state.