The vulnerability resides in the Linux kernel’s gve driver, which shares a statistics memory region between the driver and the network interface card. When the number of queues changes, the driver reallocates that region. If the queue count is increased, the NIC may write past the boundary, corrupting kernel memory; if decreased, a gap remains, resulting in incorrect statistics. This memory corruption can lead to kernel crashes, data inconsistency, or other unintended behavior.

Linux systems running kernel version 6.19 release candidates 1 through 8 with the gve driver are affected. The issue arises when changing the queue count during driver initialization or configuration.

The CVSS score of 7.8 indicates moderate to high severity. The EPSS score below 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user or a system with privileged access that can adjust the queue count during device initialization or driver configuration. Based on the description, it is inferred that an attacker could trigger an out‑of‑bounds write that might lead to kernel instability or compromise system integrity if successfully exploited.