The bug in the Linux kernel’s fbnic driver causes a deadlock in the write path when the firmware mailbox is reset. When the driver clears the BME bit while setting the FLUSH bit, staged writes remain stuck in the pipeline, and the FLUSH flag never actually terminates outstanding requests. This leads to the firmware waiting indefinitely on a flush that never completes, potentially causing I/O stalls or a kernel hang. The flaw is a logic flaw in the driver’s mailbox reset routine, classified as a synchronization or race condition that can lead to denial of service.

The issue is limited to the Linux kernel, affecting any distributions that ship an unpatched version of the fbnic network driver. All affected kernel versions before the fix, regardless of distribution or release, are vulnerable.

Official CVSS or EPSS metrics are not available, and the flaw is not listed in the CISA KEV catalog, which indicates a relatively low exploitation probability. However, the bug would require local or privileged code that can trigger a mailbox reset, so the attack vector is likely local. No documented remote exploitation exists. Even though the severity is not quantified, the potential for a deadlock‑induced denial of service makes the risk significant for systems that rely on the fbnic driver for network traffic.