The bnxt_en driver in the Linux kernel uses auxiliary devices. During device initialization the private structure is only partially populated before auxiliary_device_init() succeeds, and if later steps fail the release callback attempts to access fields that may be NULL or uninitialized. This can lead to null pointer dereference or memory corruption within kernel context, causing a kernel panic or crash. The vulnerability allows a privileged attacker to degrade system availability by triggering a failure path during device initialization or by directly manipulating the driver to simulate allocation failures.

Linux kernel installations that include the bnxt_en network driver are potentially affected. No specific kernel versions are listed, so any recent kernel build that ships with the bnxt_en module could be vulnerable until the patch is applied.

The EPSS score is < 1%, and the vulnerability is not currently listed in CISA KEV. The CVSS score is 4.4, indicating a moderate severity, but the kernel panic outcome still represents a significant denial-of-service risk. Exploitation requires the ability to load the bnxt_en device or to induce a failure during its initialization, which typically needs privileged access or physical control of the hardware. The attack vector is inferred to be local with kernel privileges; denial of service is the primary risk.