A flaw in the Linux kernel’s mtk_eth_soc Ethernet driver causes the function mtk_handle_irq_rx to receive a net_device pointer instead of the expected mtk_eth structure when the poll_controller path is taken. This type mismatch leads the kernel to dereference an invalid pointer, causing a crash that appears as a kernel panic. The crash renders the system unavailable until reboot, creating an availability denial.

Any Linux kernel build that includes the mtk_eth_soc driver and has the CONFIG_NET_POLL_CONTROLLER option enabled is vulnerable. Because the advisory does not list a specific version, all affected kernels should be considered vulnerable until the corrective patch is applied.

The CVSS score is 9.8, indicating critical severity, and the EPSS score is < 1%, indicating a low probability of exploitation, while the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered by invoking the net_device poll_controller routine, which is an option that requires the kernel to be configured with CONFIG_NET_POLL_CONTROLLER. An attacker with local or kernel‑level access able to cause that routine to run can crash the system. The primary risk is to availability; the vulnerability does not grant confidentiality or integrity compromise.