During an NTB interrupt the Linux kernel's ISR calls pci_irq_vector() which internally acquires a mutex that can sleep. In a hardirq context, sleeping is prohibited and results in a "scheduling while atomic" fault. This fault triggers a BUG message and can lead to a kernel panic or system hang. The flaw does not provide a path for code execution; it is a concurrency bug that can destabilize the kernel. The likely impact is a denial of service through kernel crash when the fault occurs.

The vulnerability is present in the ntb_epf_vec_isr() handler of the Linux kernel. All kernel releases that include this handler without the downstream patch are affected. No specific version range is listed, so any current kernel that contains the NTB EPF driver prior to applying the fix is at risk.

The EPSS score of less than 1% indicates a very low predicted exploitation probability. The vulnerability is not listed in CISA KEV. An attacker would need privileged or kernel access to trigger NTB interrupts repeatedly; this inference is based on the description that the fault occurs only when an interrupt is processed. The attack vector is internal to the kernel and not achievable from unprivileged user or remote network connections. The high CVSS score of 7.5 reflects the potential for denial of service via kernel crash.