The vulnerability arises from an incorrect counting of NAPI vectors for standalone fbnic queues. In a 64‑Tx/64‑Rx configuration the driver records 128 vectors but only allocates space for 64, leaving 64 null entries. During subsequent resource setup these null pointers are dereferenced, causing a kernel panic. The description does not specify privilege escalation or information disclosure; any such effects are inferred only from the absence of mention and should be treated with caution. The impact appears limited to a loss of availability.

All Linux kernel builds that include the fbnic driver and use a device configured with the maximum supported 64‑Tx/64‑Rx channel layout are affected. The CVE does not specify exact kernel versions, so any kernel that implements the buggy allocation path before the patch is at risk.

The CVSS score of 4.4 classifies the issue as moderate. The EPSS score of <1% indicates a very low probability of successful exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker who can alter the fbnic driver configuration or connect a device that exercises the maximum channel setting. The impact is limited to a crash of the kernel, causing a loss of availability on the affected host.