The flaw is in the Altera TSE networking driver for Linux. When a DMA mapping request fails inside tse_start_xmit(), the driver erroneously returns NETDEV_TX_OK and leaves the socket buffer (skb) allocated. The kernel’s networking stack then assumes the packet was successfully transmitted and never frees the skb, creating a memory leak. This weakness is a CWE-401 Unreleased Resource and also fits CWE-772 Unreleased Resource due to failure of proper cleanup. The result is incremental kernel memory consumption that can culminate in exhaustion, degraded performance, or a denial‑of‑service condition. The vulnerability does not grant code execution or privilege escalation.

The issue occurs in all Linux kernel releases from version 3.15 onward, including every 7.0 release candidate (rc1 through rc7). It specifically targets the "net: altera‑tse" driver that comes built into the kernel or is loaded as a module for devices using Altera TSE network hardware.

The CVSS base score of 5.5 reflects moderate severity, while an EPSS score of less than 1% indicates a very low likelihood of exploitation. Attackers would need to supply network traffic that repeatedly triggers DMA mapping failures to exploit the memory leak. The attack vector is inferred from the normal operation of the driver; it is not explicitly stated in the description.