The atl1e network driver contains a logic flaw (CWE-835) that allows the hardware to report an out‑of‑range hw_next_to_clean value (0xffff) while the PCIe link or MAC is resetting. When the driver reads this index as if it were valid, the cleanup loop never terminates, resulting in a soft lockup where the kernel stops responding to normal processes. The bug does not provide an attacker with code execution or data disclosure; it merely disrupts availability by hanging the system until it is rebooted.

All Linux kernel builds that bundle the atl1e driver and have not yet incorporated the recent fix are affected. The description does not list specific version numbers, so any system using this driver before the patch commit is at risk. The issue applies to every instance where the atl1e module is loaded, regardless of the overall kernel release, because the faulty code path is identical across versions.

The CVSS score of 4.1 and an EPSS score of less than 1% indicate a low overall severity and a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, confirming the absence of known active exploitation campaigns. Based on the description, it is inferred that the attacker would need a local or administrative foothold to induce a hardware reset or similar event; remote exploitation is not feasible. The resulting denial‑of‑service attack is limited to the affected host, causing local users or services to become unresponsive until the system is rebooted.