In the Linux kernel, the bnxt_re driver fails to validate the result of create_singlethread_workqueue() during DCB setup. When the workqueue allocation returns NULL, a later queue_work() call dereferences a null pointer, causing a kernel crash or potentially allowing an attacker to gain elevated privileges. This flaw is a classic null pointer dereference and can lead to denial of service or privilege escalation if the attacker can trigger the DCB routine.

The issue impacts all Linux kernel deployments that ship the bnxt_re RDMA driver in the mainline tree. Because the vulnerable code resides in the bnxt_re module, any host with the driver loaded and the unpatched kernel code is potentially susceptible. Specific affected kernel versions were not supplied, so all current releases containing the patch‑unapplied code should be treated as vulnerable.

The CVSS score of 7.0 indicates that the vulnerability can lead to significant damage. The unhandled null pointer dereference can crash the kernel, which in turn can be leveraged to escape to privileged code or crash the system. The EPSS score is under 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed active exploitation yet. The likely attack vector is through RDMA traffic that forces DCB initialization or via local privilege or code that can use the bnxt_re interface. The potential for privilege escalation makes this a high‑risk condition even if exploitation is not yet confirmed.