An uninitialized read‑write lock, ptp_lock, is used by the stmmac network driver when the interface is down and has never been opened. The lock is initialized only after the driver is opened, but it is accessed during configuration of TAPRIO schedules that obtain the PTP gettime64() callback. Using an uninitialized lock triggers undefined behaviour in the kernel, which can manifest as a crash, data corruption, or other kernel instability.

All Linux kernel releases that include the stmmac driver before the fix for this issue. Linux distributions that ship a kernel with this driver and have not yet applied the patch are potentially affected.

The CVSS score is 5.5 and the EPSS score is <1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no public exploitation is known. The likely attack vector is local; an attacker would need to manipulate the network interface configuration or trigger a TAPRIO schedule on an interface powered by the stmmac driver. The impact of an exploit would be kernel instability such as a panic or corrupt state, but does not provide a straightforward privilege escalation path.