In the Linux kernel, the emac network driver performs a NULL pointer dereference during initialization when the netdev_ops structure has not yet been assigned. This leads to a kernel OOPS that forces a crash and a system reboot, effectively denying availability to any local users. The flaw is a classic null‑pointer dereference (CWE‑476).

The vulnerability is present in kernel versions that include the emac driver but have not incorporated the patch that moves the initialization of netdev_ops earlier, specifically those released before the commit ded86da4bbb7 that introduced the change. Systems using device trees that configure an emac PHY, such as the MyBook Live example, will load the driver at boot or during a module load and are therefore exposed. Systems that do not load the emac driver or use alternative networking hardware are not affected.

Because the flaw manifests during driver initialization, an attacker would need the ability to influence the system at boot time or supply malicious firmware to trigger the crash. The resulting kernel OOPS forces a reboot, thus denying availability to local users. The CVSS score of 4.4 indicates low to moderate severity. No known exploitation has been reported and the vulnerability is not listed in CISA KEV, suggesting a low to moderate exploitation likelihood. It is inferred that the likely attack vector is manipulation of the device tree or firmware that loads at boot, which would cause the emac driver to load and crash.