A memory leak was found in the Linux kernel's lan966x network driver. During driver initialization a page pool is created but is not destroyed if a later DMA allocation fails. This causes leaked kernel memory that can accumulate and potentially exhaust available memory, leading to a denial‑of‑service condition. The weakness is a classic resource‑exhaustion flaw, captured by CWE-401 (Memory Leak) and CWE-772 (Missing Release of Resource).

The problem affects the Linux kernel in general and specifically applies to kernel releases 6.2 and 7.0 from release candidate 1 through 7 that include the lan966x driver. Any system running these kernel versions without the patch is vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to trigger a DMA allocation failure, which could be done by sending malformed or high‑volume traffic to the NIC, or by generating conditions that cause the driver to fail. Successful exploitation would lead to kernel memory exhaustion and service interruption. Local or privileged access to the device is likely required for reliable exploitation.