The bug arises when the bnxt_en driver creates a clone of the receive ring structure using a shallow memcpy. Pointers that belong to the clone are not reset, leaving clone pointers that still reference memory owned by the original ring. If a subsequent allocation fails, the error path frees the original ring’s memory while that memory is still being referenced, resulting in a use‑after‑free condition and potential corruption of kernel memory.

Any Linux kernel that includes the bnxt_en network driver is affected. The CVE does not list specific kernel versions, so any build containing this unpatched driver code could experience the issue. Systems that use enterprise or custom kernels with bnxt_en should verify if the fix has been incorporated.

The flaw carries a CVSS score of 5.5, indicating moderate severity. Its EPSS score is below 1% and it is not listed in CISA’s KEV catalog, reflecting a low likelihood of known exploitation. Exploiting the flaw would likely require a scenario where the driver triggers a queue restart failure after an allocation failure, which typically demands privileged access to the network driver. Because the description does not describe an externally exploitable condition or public exploit, the risk remains theoretical until evidence of exploitation emerges. The likely attack vector is triggering a queue restart failure in a context where the kernel has sufficient privileges to interact with the bnxt_en driver.