This vulnerability arises from a NULL pointer dereference in the idpf driver during initialization. If allocation of virtual ports, network devices, or configuration buffers fails, the driver still sets the adapter's maximum virtual port count and later accesses this value, leading to a kernel panic. The crash results in a full system reboot or halt, directly compromising system availability.

The issue affects all Linux kernel releases that contain the idpf driver before the patch that corrects the adapter->max_vports assignment. Therefore, any system running a kernel version that includes this driver, before the fix, is potentially vulnerable, regardless of the distribution vendor.

Because the bug manifests only after an allocation failure during driver initialization, the attack surface is relatively narrow. An attacker must have local or privileged access to load or reset the idpf device to trigger the crash. The EPSS score indicates a very low probability of exploitation (less than 1%), and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, a successful trigger results in a denial‑of‑service event, so the risk to mission‑critical systems is significant if the required local privilege can be obtained.