In the fnic driver, the function fnic_fcoe_process_vlan_resp() allocates a VLAN descriptor using kzalloc_obj() with the default GFP_KERNEL flag while holding the vlans_lock spinlock. GFP_KERNEL permits sleeping, which is disallowed in an interrupt‑safe spinlock context; the result is a sleeping‑from‑invalid‑context warning or, in worst case, a deadlock that affects kernel stability.

All systems that run the Linux kernel including an unpatched fnic_fcoe_process_vlan_resp() function are affected. The vulnerability exists in any kernel build that contains this function without the fix that switches the allocation flag to GFP_ATOMIC. No specific kernel release is identified, so any kernel with the vulnerable code path is at risk.

The CVSS base score is 4.4, and the EPSS score is < 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require local access to the affected system and the ability to interact with the fnic driver, making it a kernel stability issue rather than a remote code execution vector.