The fnic driver in the Linux kernel allocates VLAN descriptors using kzalloc_obj() with the default GFP_KERNEL flag while the vlans_lock spinlock is held. This flag allows sleeping, which is illegal under an interrupt‑safe spinlock and can trigger a sleeping‑from‑invalid‑context warning or, in the worst case, a deadlock. The vulnerability therefore creates a kernel stability issue that can manifest as serious performance degradation or system crashes. The weakness is categorized as CWE‑663.

All Linux kernel builds that include the fnic_fcoe_process_vlan_resp() function without the fix are affected. The vulnerability is present in any kernel that has the vulnerable code path; no specific kernel version numbers are listed in the advisory. Users of unpatched kernels on systems that load the fnic driver (typically Fibre Channel over Ethernet environments) are at risk.

The CVSS base score of 4.4 indicates a moderate impact, while the EPSS score of < 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is privileged access to the host and the ability to trigger the fnic driver’s VLAN response processing, making the attack vector a local kernel module interaction rather than a remote injection.