Linux Kernel EUVD-2026-45541

Exploitation requires the target system to actually run the Airoha ethernet driver (airoha_eth) on Airoha/MediaTek EN7581-class hardware - the vulnerable code in airoha_dev_xmit() only executes on that specific NIC. It is triggered along the local transmit path by sending fragmented (nr_frags > 0) packets through that interface, so the actor needs local ability to generate such traffic, not remote network reach despite the auto-assigned AV:N. Limiting factors: the effect is a possible page fault rather than reliable code execution or data disclosure (the read values are never consumed), it is hardware-specific and therefore absent on the vast majority of systems, and it is not present unless the airoha driver is loaded and bound to a device.

Signals conflict sharply and should be reconciled before prioritization. The supplied CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H implies remote, unauthenticated, full-triad compromise, but the description describes a local kernel transmit-path bug whose only realistic effect is a page fault (availability/DoS); the confidentiality and integrity claims are not supported since the uninitialized values are never used - verify with vendor, this vector is almost certainly auto-generated and overstated. Corroborating the low real-world risk: EPSS is 0.15% (5th percentile), there is no KEV listing, and no public exploit or POC is identified. No SSVC decision data is provided. On balance this is a high-CVSS-but-low-real-risk issue: it is a legitimate correctness/robustness fix worth patching in the normal cycle, but not an emergency, and it primarily matters to the narrow set of deployments running Airoha EN7581 networking hardware.

An attacker or workload with the ability to drive packet transmission through an Airoha EN7581 network interface sends fragmented (scatter-gather) traffic that exercises the multi-fragment transmit path, causing the driver to read an uninitialized fragment address on the loop's final iteration. If that read hits an unmapped address it triggers a kernel page fault, potentially crashing the system (local denial of service). No public exploit or POC has been identified, and the uninitialized values are never used for further processing.