The vulnerability is a memory leak in the Linux kernel's GUE (Generic UDP Encapsulation) handling code. When a GUE packet contains an inner IP protocol number of zero, the kernel fails to free the skb data structures properly, leaving a dangling reference that accumulates over time. This memory leak can eventually exhaust kernel memory, destabilizing the system and potentially causing a denial‑of‑service condition.

The flaw exists in the Linux kernel, particularly in version 6.19 and its release candidates (rc1 through rc6). It may also affect other kernel releases that contain the same unpatched GUE code path, but the CPE list confirms the vulnerability is present in 6.19 and later iterations.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to inject malformed GUE packets, which typically requires access to a TUN/TAP interface or privileged user actions. If such access is available, the memory exhaustion can be triggered by sending a rapid stream of packets, leading to a denial-of-service. While the exploit path is local or requires elevated permissions, the impact can be system‑wide if the kernel heap becomes exhausted.