The flaw in the Linux kernel’s IFB driver occurs when statistics are gathered for an interface configured with more receive queues than transmit queues, causing the ethtool stats routine to walk beyond the allocated per‑queue private data block and perform an out‑of‑bounds read, which triggers a KASAN fault and can crash the kernel. This memory corruption is classified as CWE‑125 and results in a denial‑of‑service condition. While it does not directly grant code execution or data exfiltration, the fault could serve as a foothold if other weaknesses were present.

All Linux kernel implementations that include the IFB (Intermediate Functional Block) driver are affected. The problem manifests on any system that creates an IFB interface with an asymmetric queue configuration—e.g., running `ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb`. The upstream patch is applicable to every kernel version containing the IFB module, so distributions that have not yet shipped the fix remain vulnerable.

The vulnerability has a CVSS base score of 5.5, indicating medium severity. The EPSS score is less than 1%, suggesting very low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. The bug is triggered when an ethtool statistics request accesses per‑queue data for an IFB interface whose receive queue count exceeds its transmit queue count. The vulnerable code traverses past the allocated private data, leading to an out‑of‑bounds read and a KASAN fault that can crash the kernel, causing a denial‑of‑service. The attack would presumably require the ability to run ethtool against the affected interface, which normally requires root or CAP_SYS_ADMIN privileges. This requirement is inferred from typical ethtool usage rather than stated explicitly in the CVE data.