The Linux kernel’s handling of ethtool flash operations contains a flaw where the completion routine ethnl_ops_complete() is skipped after a failed validation that has already called ethnl_ops_begin(). This omission can leave resources allocated or cause the kernel to wait forever for a completion that never occurs, resulting in a system hang or loss of network service. The weakness is a CWE‑459 improper release of resource or memory, which directly leads to denial of service conditions.

The vulnerability is present in the core Linux kernel for all releases that include the ethtool flash handling code prior to the patch. According to the CPE data, versions such as 7.1 RC1 through RC5, and any kernel builds that incorporate this code are potentially affected. All Linux distributions deploying these kernel versions without the fix would be exposed.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would most likely require privileged access—typically root or elevated capabilities—since the ethtool flash command is generally restricted to administrators. Consequently, overall risk remains low and exploitation is considered theoretical at the current time.