A defect in the Linux AM65 CPSW driver causes the MAC port identifier to be extracted from a 16‑bit source tag that contains an arbitrary, hardware‑reserved upper byte. The upper byte is incorrectly interpreted as part of the port ID, leading to an invalid index that can trigger an out‑of‑bounds memory access in the driver. This crash can compromise availability or permit more severe exploitation when combined with other kernel vulnerabilities.

Linux kernel users employing the TI Am65 CPSW (cpsw‑nuss) network driver are affected. The bug is present in kernel releases that include the outdated port_id extraction logic; the fix is applied in the commit series referenced in the provided patch URLs.

The flaw can be triggered by receiving a packet whose source tag has a non‑zero, arbitrary upper 8 bits; this is a network‑based attack vector inferred from the packet reception path. While an EPSS score is not reported and the vulnerability is not listed in KEV, the potential to cause a kernel panic makes it a high‑impact condition. Because the bug is exercised by external traffic, it is likely correlated with exploitation attempts from remote attackers.