The vulnerability is in the ethtool coalesce configuration handling of the Linux kernel. During a profile update, the kernel walks a netlink nested attribute list that can contain an arbitrary number of entries controlled by the caller. The update function writes each entry into an array allocated with space for only five elements without verifying that the indexing counter stays within bounds. This out‑of‑bounds write overflows the allocated memory and corrupts kernel heap structures, resulting in a kernel crash or, if the overwritten data affects executable code or pointers, a potential privilege escalation.

All Linux kernels that include the affected ethtool code path are vulnerable. The CVE entry does not specify exact kernel versions, implying that all in‑tree kernels prior to the upstream patch are at risk. Distributions that ship the Linux kernel, such as Ubuntu, Fedora, RHEL, CentOS, Debian, and others, must ensure their kernel images contain the fix.

The CVSS base score of 7.8 denotes a high‑impact vulnerability. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to send crafted netlink messages to the kernel and generally requires CAP_NET_ADMIN capability, so it is a local privileged or trusted‑process exploit. The likely attack vector involves an attacker with sufficient privileges sending a netlink message that contains more than five nested ‘irq_moderation’ attributes. By doing so, the attacker can trigger the array out‑of‑bounds write, causing kernel memory corruption that may lead to a crash or to privilege escalation if control over the overwritten data is achieved.