The vulnerability occurs in the bcmgenet network driver when the RBUF_EEE_EN and RBUF_PM_EN bits are set in the RBUF_ENERGY_CTRL register while the MAC operates in Energy Efficient Ethernet (EEE) mode. This configuration interrupts the receive path, causing incoming packets to be acknowledged by the hardware but never forwarded to DMA, so the kernel never increments the rx_packets counter. In some scenarios the corruption triggers a paging fault during skb_release_data, resulting in a kernel crash. Consequently, the affected network interface stops delivering traffic, rendering the system unusable for network communications.

The issue affects the Linux kernel’s bcmgenet driver used on Broadcom Ethernet hardware such as the BCM54213PE on a Raspberry Pi 4 Model B and Broadcom 4908‑family boards. It is present in all kernel releases that include the bcmgenet driver before the patch that clears the EEE and PM bits in bcmgenet_eee_enable_set. Older kernels also suffer the defect when Tx‑LPI is activated via ethtool. Any Linux system that employs these NICs and has the default EEE setting enabled is potentially impacted.

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score of less than 1% indicates a very low probability of being exploited in the wild. Because the flaw resides in privileged kernel driver code and requires the device to be in EEE mode, successful exploitation likely needs local or root access and control over the network adapter. It is inferred that an attacker would need to manipulate the NIC's EEE settings, a capability that typically requires local or root privileges. It is not currently listed in the CISA KEV catalog. Nonetheless, denial of service of a network interface can be highly disruptive for exposed services.