An uninitialized read‑write lock is used by the stmmac network driver when the interface is down and not yet opened. The use of this uninitialized lock triggers undefined behaviour, which can manifest as a kernel panic, data corruption, or a potential local privilege escalation if an attacker can trigger the path. The weakness corresponds to common categories of improper initialization and use of uninitialized variables.

All Linux kernel releases that include the stmmac driver before the fix for this issue. Linux kernels on any distribution that ship with this driver are potentially affected until the patch is applied.

The CVSS score is not reported, and the EPSS score is unavailable, so the exact quantitative risk cannot be determined from the data. The lack of KEV listing suggests no publicly known exploitation yet. However, because the flaw involves kernel memory handling and can lead to a crash or corrupted state, the potential impact is high for systems that load the driver on a vulnerable kernel. The likely attack vector is local, requiring the attacker to have some influence over the network interface or to load the driver, which typically requires root or kernel module privileges. With the vulnerability present, an attacker could trigger a kernel failure by causing a taprio schedule configuration that uses the uninitialized lock.