This vulnerability is a defect in the MediaTek Ethernet driver within the Linux kernel. When the driver registers multiple network interfaces, a failure of register_netdev() for any device causes the error path to skip the proper cleanup of previously registered devices. The remaining devices are freed while still marked as registered, triggering the kernel BUG_ON that checks for an unregistered state and crashing the kernel. The bug was identified by the patch that reroutes the failure to an appropriate unregister routine.

The flaw affects all Linux systems that include the MediaTek Ethernet driver in the kernel code base, regardless of distribution, as the knowledge base lists only 'Linux:Linux' with no specific version constraints. Because the CPE refers to the generic Linux kernel, any kernel release that has not applied the fix is eligible for exploitation. Administrators should therefore verify whether their kernel sources contain the mtk_eth_soc driver and whether the fix from the commit referenced in the advisory is present.

The vulnerability does not have a published CVSS score or EPSS value, and it is not cataloged in the CISA KEV, which suggests no confirmed exploitation activity. Nevertheless, a local attacker with the ability to influence the device probe sequence—such as through privileged code or by booting a custom kernel—could trigger the crash and cause a denial of service. The absence of remote exploitation evidence implies this is a local privilege escalation or denial vector, so the primary risk is system downtime until the driver is updated or disabled.