The bnxt_re RDMA driver on Linux includes a bug where bnxt_qplib_alloc_dpi records a success status even when the ioremap call fails. The driver therefore continues as if a valid memory mapping existed, leading to the use of an unintended null or invalid pointer. This can trigger a kernel panic and take the whole system offline, representing a classic denial‑of‑service failure mode.

Linux kernel builds that contain the bnxt_re RDMA driver before the committed patch are potentially affected. No specific kernel versions are enumerated, so any kernel that includes the pre‑patch driver may be vulnerable. Users running such kernels should verify whether their kernel version incorporates the resolution.

The vulnerability carries a CVSS score of 9.2, signifying critical severity. EPSS indicates an exploitation probability of less than 1%, which suggests limited likelihood in the wild. Exploitation would require access to a system with kernel privileges or the ability to load a malicious module, so the attacker only needs local privilege escalation. It is not yet listed in CISA's KEV catalog.