The Linux kernel mvpp2 driver contains a buffer overflow that occurs when the driver reconfigures memory pools during an MTU change without validating the number of pools against the maximum allowed. This out‑of‑bounds write corrupts data in the kernel page_pool array, opening the possibility for arbitrary kernel memory corruption that a local attacker could turn into code execution or privilege escalation.

All Linux kernels that include the mvpp2 driver and run on hardware MVPP22 or newer are potentially affected as long as the per‑CPU buffering scheme is enabled and the number of pools (nrxqs * 2) is permitted to exceed MVPP2_BM_MAX_POOLS (8). Distributions shipping a kernel code path that has not been updated to incorporate the commit addressing this flaw are vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest no widespread exploitation yet. Exploitation requires local or privileged access to trigger an MTU change on an interface using the flawed driver, making the attack vector likely local. However, the kernel memory corruption potential keeps the risk significant and warrants prompt remediation.