The Linux kernel’s lan743x network driver may attempt to lock an uninitialized spinlock during the device probing process. Because the spinlock has not been initialized before use, the kernel’s spinlock debugging mechanism or core behavior can be violated, leading to a kernel panic or other undefined behaviour. This is a CWE-908 vulnerability that can compromise system integrity and availability.

The flaw exists in the lan743x driver shipped with the Linux kernel. Any installation of a Linux kernel that includes this driver prior to the fix is vulnerable. Distribution vendors and kernel maintainers that have not yet applied the upstream patch are also affected. No specific kernel version numbers are listed in the CVE data, so the risk applies to all unpatched kernels that contain the lan743x module.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating that no publicly known exploit has been documented. The CVSS score of 5.5 indicates a moderate severity. Based on the description, the likely attack vector requires local or physical access to the network adapter to trigger the probe routine. An attacker with that access could deliberately load the device during system boot or during device hot‑plug, potentially causing a kernel panic and a denial of service. The risk is moderate in environments where the vulnerable driver is in use and physical access is possible, but the exploitation window may be limited to initial device initialization events.