The gve driver in the Linux kernel contains a logic flaw in the gve_tx_clean_pending_packets function when operating in DQ‑QPL mode. The routine mistakenly uses the RDA buffer cleanup path, interpreting buffer identifiers as DMA addresses and iterating beyond the size of the dma array. This leads to out‑of‑bounds array accesses and attempts to unmap memory locations that were never mapped, which can trigger kernel panics or other forms of instability. The vulnerability does not provide an avenue for code execution; its effect is limited to disabling affected systems through denial of service.

All Linux kernel versions that include the gve driver and are compiled with QPL support are susceptible. The supplied CPE strings indicate the issue is present in kernel releases from version 6.6 and the 7.0 release candidates up through rc7. The vulnerability is not tied to a single vendor identity beyond the generic Linux kernel, making any system running an unpatched gve driver at risk.

The moderate CVSS score of 5.5 reflects the moderate impact domain of a denial‑of‑service that requires local interaction with the gve driver. The associated EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The bug is triggered by normal network traffic or driver activity that activates the faulty cleanup path, indicating a local attack vector. No publicly available exploits are known, and the primary consequence is a forced reboot or service interruption caused by kernel crashes.