The vulnerability is a null pointer dereference caused by a race condition between the allocation of a dummy network device and the registration of other network interfaces. This is a CWE-476 vulnerability. When a device is brought up during a brief window before the dummy netdev and its NAPI are initialized, the driver dereferences a null pointer, leading to a warning and a failure to open the interface.

The issue affects Linux kernel builds that contain the MediaTek mtk_eth_soc Ethernet driver, especially on NetSys v1 and v2 SoCs such as MT7621, MT7622, MT7623, and MT7629. Any kernel version prior to the commit that allocates the dummy netdev early is affected. The fix is present in later kernel releases that incorporate the upstream commit referenced by the provided Git URLs.

The vulnerability is not listed in the CISA KEV catalog and its EPSS score is unavailable, indicating limited publicly known exploitation data. Exploitation requires influence over the system’s boot or network configuration to bring an interface up during the vulnerable window, which normally demands privileged local access. While a local privileged user could trigger a denial of service by forcing an interface to come up early, remote exploitation would be unlikely without additional privileged compromise. The lack of a CVSS score in the data suggests that the severity is high only in terms of service interruption rather than a direct security breach.