A flaw in the IBM emac driver causes an unconditional call to napi_disable() during module removal. When NAPI has never been enabled, the function spins indefinitely waiting for a state bit that never clears, leading to an unbounded kernel loop and a system freeze. This defect directly compromises system availability by rendering the entire kernel unresponsive.

All Linux kernel installations that contain the IBM emac driver are potentially affected. The CNA list lists Linux:Linux with no specific version windows, and no version ranges are provided by the advisory. Consequently, any kernel revision including this driver can be vulnerable unless patched.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits to date. Exploitation would require an attacker to unload or remove the affected kernel module, a privilege generally reserved for privileged users or malicious code with elevated rights. If successful, the system will freeze, resulting in a denial‑of‑service outcome. Consequently, while the exploit likelihood remains low, the impact is significant for systems relying on the driver or able to be coerced into module removal.