The defect lies in the ethtool kernel module’s handling of flash operations. When validation fails, the routine ethnl_ops_complete() is omitted even though ethnl_ops_begin() has already been called. Because the operation is left incomplete, the kernel may keep resources allocated or wait indefinitely for a completion that never arrives. This flaw can lead to a hang or a loss of network service, in line with CWE‑459 (Improper Release of Resource or Memory).

The affected product is the Linux kernel. All kernel releases that include the ethtool flash handling code prior to the patch are potentially vulnerable, regardless of distribution or specific kernel version. No special product variants or modules were identified beyond the core kernel.

According to the published metrics, the CVSS score is 5.5, reflecting moderate severity. The EPSS is less than 1 %, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The exploit would require privileged access, such as the ability to run the ethtool flash command, which typically requires root or elevated capabilities. This inference is based on the fact that ethtool commands generally require admin privileges. Consequently, the overall risk is low, with exploitation considered theoretical at this time.