The Linux kernel fbnic driver has an issue where a doorbell write is omitted when the final packet of a transmission burst is dropped. Because fbnic_tx_map() leaves the descriptor of the last packet without a doorbell notification, earlier packet descriptors remain invisible to the hardware. Without the necessary completion request the hardware cannot complete transmission of those packets, causing the transmit queue to stall and network traffic on that interface to cease. The bug was introduced by the logic that counts on the last packet of a burst to perform the doorbell write, and was fixed by adding a completion request on the meta descriptor when a drop occurs. This defect aligns with CWE-459, a failure to properly signal the hardware when a packet drop occurs.

Any Linux system running the fbnic network driver before the kernel commit 28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9—or any derivative that has not applied the patch—is vulnerable. This includes all distributions that ship the standard Linux kernel and load the fbnic module. No specific distribution releases or patch levels are listed, so the risk applies to any kernel that contains the affected driver code and has not been updated.

The EPSS score is below 1 % and the vulnerability is not listed in CISA's KEV catalog, indicating a low probability of exploitation in the wild. The CVSS score is 5.5, reflecting a moderate severity. The flaw is triggered when a burst of traffic ends with a dropped packet, an event that can be caused by normal traffic or by an attacker who can generate such traffic patterns on the host or the network interface. Remote exploitation without the ability to influence traffic flow is not documented. Once triggered, the denial of service persists until the driver is reset or the system is rebooted.