This flaw in the Linux kernel’s dpaa2‑switch driver arises during the removal of individual switch ports. Because NAPI instances are shared and only disabled once the last port is taken down, the kernel deletes them prematurely while ports are still being unregistered. The resulting improper deallocation can trigger kernel crashes or instability, effectively causing a denial of service.

The vulnerability affects all Linux kernel builds that include the dpaa2‑switch driver. The issue has been discovered and fixed in commits referenced in the advisory, and any system currently running a kernel version that contains the unpatched dpaa2‑switch code is potentially affected.

The CVSS score is 5.5, indicating moderate severity, while the EPSS score is less than 1%, showing a low probability of exploitation. The flaw is not listed in CISA KEV, suggesting limited exploitation evidence. However, because the defect can lead to a kernel panic, an attacker with local device removal privileges—typically an administrator or a compromised privileged user—could trigger the error. Denial of service is the primary consequence, and the risk is elevated for environments that frequently remove or replace dpaa2‑switch devices.