The Linux kernel vulnerability is located in the sparx5 switchdev module. During initialization, sparx5_register_notifier_blocks registers a blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregisters the switchdev and netdevice notifiers but leaves the blocking notifier registered. This omission can leave a dangling notifier that may be invoked by later code paths, producing undefined behavior or instability. The flaw is a resource management error.

Linux kernel distributions that include the sparx5 switchdev implementation are affected. The CPE entry indicates the entire Linux kernel family. No specific versions or patch levels are listed in the provided data.

The CVSS score of 7.8 and an EPSS score of <1% suggest moderate to high severity but a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been documented. The flaw is triggered by an internal failure during kernel initialization – specifically, the failure of ordered workqueue allocation – so the attack vector is inferred to be internal boot or module load failure rather than an externally observable attack.