A missing call to disable NAPI in the Octeon network driver causes the driver to free its interrupt resources while its poll function could still be running. When the driver then the platform structure holding the NAPI instance, the poll function may execute on freed memory, leading to a use‑after‑free kernel crash. This fault allows an attacker who can trigger the driver shutdown path to cause a denial of service.

The vulnerability affects the Linux kernel’s staging octeon driver. Any system running a kernel that includes the octeon driver without the recent patch is impacted. The issue is confined to the kernel and not specific to a particular distribution or kernel version beyond the presence of the old octeon driver code.

The CVSS score is 5.5, and the EPSS score is <1%, indicating a moderate severity with a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Because the fault occurs during driver removal, the typical exploitation window requires the ability to trigger a reset or module removal, implying a local or kernel‑level attack vector. While the impact is a powerful kernel crash, the likelihood of exploitation without direct control over the driver is low. Updated kernels that contain the fix eliminate the risk.