The Linux kernel ethtool module contains a flaw where the function module_flash_fw_schedule does not release a network device reference and clear its in_progress flag when a firmware flash operation fails. This omission can lead to a stale reference while the rtnl_lock is held, potentially causing kernel instability and preventing the affected network device from being cleanly removed. The weakness is a missing resource release (CWE‑772).

All Linux kernel distributions that compile the ethtool module without the patch that restores proper reference handling are affected. This includes any kernel version prior to the commit referenced in the kernel tree that fixes the reference handling in module_flash_fw_schedule. Specific version numbers are not supplied, so any kernel lacking the fix should be treated as vulnerable.

The base CVSS score of 5.5 denotes medium severity. EPSS is under 1 %, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation would require local or privileged access to invoke the firmware flash ability of ethtool, making the attack vector likely local or insider. Successful exploitation could lead to a local denial‑of‑service of the networking subsystem but does not provide remote code execution.