The bug removes page recycling from the XDP_DROP path in the Texas Instruments ICSSG PRU Ethernet driver when operating in non‑zero‑copy mode. This results in the page buffers used by dropped packets never being returned to the page pool, creating a memory leak that can grow until the kernel runs out of memory and the out‑of‑memory killer terminates processes or the entire system. The weakness is a classic memory‑leak flaw (CWE‑772) and a violation of proper memory deallocation (CWE‑401). The consequence is a denial‑of‑service that affects the host as a whole.

The issue resides in the Linux kernel’s net:ti:icssg‑prueth driver. Any Linux kernel build that predates the patch commit is vulnerable; the CPE list includes kernel releases from 7.0 release candidates up to and including 7.0 rc4. Because no specific patch version range is supplied, all kernels released before the affected commit should be considered at risk.

The EPSS score of less than 1 % indicates a low likelihood of exploitation, but the CVSS score of 7.5 denotes high severity. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The injection of malicious packets that reach an XDP program performing a drop in standard page‑pool mode is the inferred attack scenario; this inference is drawn from the description of the driver behavior but is not explicitly stated in the CVE record. Successful exploitation would require that the host process the offending network traffic, leading to a memory‑leak and eventual out‑of‑memory condition.