In the Linux kernel, a defect in the fbnic Ethernet driver causes an error pointer returned when payload page pool allocation fails to be passed to page_pool_destroy instead of the actual header page pool. This misuse can dereference the error pointer, triggering a kernel panic and leaving the header page pool allocated, which results in a denial of service.

The vulnerability applies to all Linux kernel releases prior to the inclusion of the fbnic cleanup fix. Affected systems are those running a kernel that includes the fbnic driver without the patch commit; no specific version range is provided explicitly in the advisory.

The CVSS score of 4.1 indicates low to moderate severity, though the vulnerability can still cause a kernel panic. No exploitation evidence or explicit threat model is documented in the advisory. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The attack vector is inferred to be local or remote via the network interface managed by fbnic, as the failure originates during payload allocation in the driver. The overall risk is considered low to moderate, and the likelihood of exploitation without system access remains uncertain.