The vulnerability is a double free flaw in the bnx2x network driver’s firmware initialization routine. During error handling, the routine frees three internal pointers but does not null them. A subsequent unconditional free in the release routine, executed after a failed initialization, attempts to free already freed memory. This double free can corrupt kernel heap structures, potentially leading to a kernel crash or, if exploited maliciously, compromise system stability or security.

The flaw exists in the Linux kernel’s bnx2x driver. No specific kernel version range is stated in the available data, so any kernel build containing the pre‑fix bnx2x implementation is at risk.

The CVSS score is 4.1, indicating moderate severity. The EPSS score of 0.00168 (<1%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is documented. Exploitation would likely require local kernel operation or privileged interaction with the bnx2x driver, and could manifest as a denial of service through a kernel crash or potential privilege escalation if memory corruption is leveraged.