The vulnerability resides in the Linux kernel’s gve driver, which shares a statistics memory region with the corresponding network interface card. When the number of queues changes, the driver reallocates the region. If the queue count is increased, the NIC writes beyond the allocated bounds, corrupting kernel memory. Decreasing the count creates an unused gap, distorting statistics. Such memory corruption can cause crashes, data corruption, or, in the worst case, provide a foothold for privilege escalation.

Any Linux system running a kernel that includes the gve driver is potentially affected. No specific kernel versions are listed, so all current kernels containing this driver should be treated as vulnerable until the patch is applied.

The CVSS score of 7.0 indicates moderate to high severity. EPSS indicates a probability of exploitation of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user or an attacker with privileged access who can alter the queue count during device initialization or driver configuration. Based on the description, an attacker might trigger an out‑of‑bounds write that could lead to arbitrary code execution in kernel mode if exploited successfully.