The gve driver in the Linux kernel contains a flaw in the gve_tx_clean_pending_packets function when operating in DQ-QPL mode. It incorrectly reuses the RDA buffer cleanup path, interpreting buffer IDs as DMA addresses and iterating beyond the bounds of the dma array. This causes attempts to unmap incorrect memory locations and can trigger out-of-bounds array access, which in turn may lead to kernel panics or unpredictable behavior. The vulnerability is a memory corruption issue that can destabilise the system but does not provide remote code execution. The description explicitly mentions out‑of‑bounds access warnings and the need for a fix that properly checks for QPL mode and delegates cleanup to gve_free_tx_qpl_bufs().

Any Linux kernel build that includes the gve driver and has not yet applied the patch that resolves CVE‑2026‑23386 is vulnerable. The vendor of the affected product is Linux and the product is the Linux kernel. Specific version numbers are not listed in the advisory, but the vulnerability applies to all kernels that expose the gve driver and run in DQ‑QPL mode.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The bug appears to require local interaction with the gve driver—likely through normal network traffic or driver activity—to trigger, so it is inferred that the attack vector is local. No public exploit has been reported, and the impact is primarily a denial of service through kernel crashes.