The Android‑style net/ionic driver incorrectly resolves a queue partner for a hardware timestamp RX queue by indexing the normal txqcqs array with an out-of-range index. This produces a read that references one element past the bounds of the array and writes through the derived pointer, corrupting kernel memory. The damage can manifest as service interruption or, if an attacker controls the context, escalation to root privileges due to the corruption of critical kernel data structures.

Any Linux system that deploys the net/ionic network driver before the corrective patch is applied. This includes all mainstream distributions shipping an unmodified kernel build at the time of the vulnerability disclosure. The specific version range is not enumerated in the CVE record, but any kernel revision older than the fix commit is considered vulnerable.

The flaw involves a classic out-of-bounds write (CWE‑787), which is highly exploitable in a kernel context. Although no EPSS or KEV status is recorded, the absence of a public KEV listing does not diminish the intrinsic risk; memory corruption in the kernel is a severe attack vector. An attacker likely needs local or device‑level privileges to trigger the XDP_TX path that triggers the faulty lookup, but if a privileged user can manipulate NIC queues, the bug can be leveraged to cause privilege escalation or denial of service.