The fbnic network driver in the Linux kernel contains a flaw where the number of active NAPI vectors is not reset when the vectors are freed during power‑management transitions. This oversight leaves the driver’s napi array pointing at deallocated memory. When the driver later accesses this stale pointer—such as during a device removal, forced suspend/resume cycle, or a failed recovery path—a NULL pointer dereference occurs, crashing the kernel. The crash halts all kernel‑space operations, effectively denying service to the affected system.

All Linux kernel builds that include the fbnic driver for network interface controllers are potentially affected. No specific version range is listed, so any kernel running this driver before the patch may be at risk.

The CVSS base score is 4.1, indicating low to medium severity. The EPSS score is < 1%, implying an exceptionally low probability of exploitation. The vulnerability is not listed in CISA KEV, and no public exploit is known. Attackers would need local access and conditions such as a PCIe error recovery failure, an incomplete resume, or manual device removal to trigger the kernel crash. Although the impact would be a kernel crash leading to a denial of service, the path to exploitation requires privileged actions and a specific device lifecycle scenario, so the overall risk remains low to moderate.