The bcmasp driver in the Linux kernel contains an improper initialization bug where the txcb->last flag is set only for the final fragment of a socket buffer. When earlier fragments are sent, the flag may retain a stale true value. If a descriptor that still holds this stale flag is reused while the ring buffer fullness is under‑reported, the reclamation logic interprets the packet as complete, frees the socket buffer prematurely, and leaves remaining fragments in flight. This can corrupt the network stack and, as a consequence, disrupt connectivity or cause a kernel failure.

Linux kernels that include the bcmasp driver are affected. The driver is part of the upstream Linux kernel, so any distribution kernel that ships with bcmasp, regardless of vendor, remains vulnerable until the fix is applied. No specific version range is listed, implying that all kernels before the release of the patch are potentially at risk.

The CVSS score of 7.8 marks the issue as high severity, while the EPSS score of < 1% indicates a very low probability of exploitation in the wild and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector involves an adversary injecting or manipulating multi‑fragment network traffic on bcmasp interface or exploiting conditions that cause the ring buffer fullness check to be inaccurate. Given the potential for a system crash or abrupt service loss, the risk is considered significant for environments where the driver is kernel‑level and network traffic is critical.