In the Linux kernel, a defect in the fbnic Ethernet driver causes an error pointer returned when payload page pool allocation fails to be passed to page_pool_destroy instead of the actual header page pool. This misuse can dereference the error pointer, triggering a kernel panic and leaving the header page pool allocated, which results in a denial of service.

The vulnerability applies to all Linux kernel releases prior to the inclusion of the fbnic cleanup fix. Affected systems are those running a kernel that includes the fbnic driver without the patch commit; no specific version range is provided explicitly in the advisory.

The bug is high severity because it can cause the kernel to crash, but no exploitation evidence or explicit threat model is in the advisory. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The attack vector is inferred to be local or remote via the network interface managed by fbnic, as the failure originates during payload allocation in the driver. The risk remains high but the likelihood of exploitation without system access is uncertain.