A memory leak was identified in the Linux kernel airoha driver when processing non‑linear socket buffers in airoha_qdma_rx_process(). Errors such as invalid packet payload lengths or exhaustion of buffer fragments cause the driver to skip returning a page pool fragment to the pool, leading to gradual consumption of kernel memory. Over time this can deplete available memory, resulting in system instability or a denial of service.

The flaw affects any Linux kernel installation that includes the airoha driver for QDMA network interfaces. Specific kernel versions are not listed, so any supported kernel running that driver is potentially vulnerable until the fix is applied.

The CVSS score is not provided and the EPSS is not available, so an exact quantitative risk is unknown. If an attacker can send crafted packets to the vulnerable NIC, they could trigger the error path remotely and cause memory exhaustion, making this a high‑risk denial of service vulnerability. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation at this time.