The Linux kernel’s Cortina Ethernet driver mishandles the fragment counter in its gmac_rx() NAPI poll function. When the ring buffer empties during a poll cycle, the packet remains partially assembled in the socket buffer but the fragment counter is incorrectly reset to zero on the next invocation. This logic flaw, classified as CWE‑437, can lead to incomplete or corrupted packet assembly and subsequent memory corruption, potentially causing a kernel panic.

Systems running the Linux kernel with the Cortina driver prior to the inclusion of the fix commit 46806096f35b8d3dfa2f321ddd77f597edcdb85f are affected. All Linux kernel releases that match the vendor name Linux and the product name Linux kernel, before the patch, are therefore at risk.

The vulnerability carries a CVSS score of 9.8, indicating a very high potential impact. Its EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation to date, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be external; an attacker could send crafted Ethernet frames over an interface that uses the Cortina driver to trigger the erroneous reset of the fragment counter during packet reception, leading to memory corruption and a possible denial of service.