The fbnic Ethernet driver in the Linux kernel processes ring size values received through ethtool. The driver uses the rounding function roundup_pow_of_two, which is undefined for a zero input. The original implementation did not enforce the minimum‑size check when the value was zero, allowing the driver to receive an invalid size. The patch ensures that zero is left unchanged during rounding and that the subsequent minimum‑size check rejects the value deterministically, preventing malformed data from propagating into the driver’s internal state. Because the undefined behavior could cause the driver to store or use an incorrect ring size, the impact might be a disruption of network driver operation or, in the worst case, a kernel crash, representing a classic input‑validation flaw (CWE-1284).

Any Linux system that runs a kernel containing the fbnic driver and exposes ethtool ring‑size configuration can be affected. The specific kernel versions are not listed, so the flaw may exist in any release before the patch that maintains zero values during rounding. Systems that rely on the fbnic driver for network interfaces are therefore potentially vulnerable.

The CVSS score of 4.4 places the vulnerability in the moderate range. An EPSS score of less than 1% indicates that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require using ethtool or a similar tool to set a ring size, so local or privileged access is necessary. The impact is limited to the behavior of the affected network interface and does not directly expose user data or other system services.