An off‑by‑one error in the DMA error cleanup path of the e1000/e1000e network driver causes a single DMA mapping to remain allocated when a TX buffer mapping fails. The incorrect decrement of the mapping counter before unmapping prevents that buffer from being freed and creates a kernel‑mode memory leak that can exhaust DMA resources over time.

Linux kernels that have not incorporated the patch commits that fixed the checksum error in the e1000/e1000e drivers are affected. Any system with an Intel 8254x‑based network adapter identified by the e1000 or e1000e driver module is at risk if that module is loaded in kernel space.

The vulnerability is scored moderate at 5.5 on CVSS and has an EPSS below 1 %, and it is not listed in CISA KEV. The driver operates in kernel space, so an attacker would need local access or higher privileges to trigger the erroneous buffer mappings, although the description does not specify the exact privilege requirement. Repeated exploitation could deplete DMA resources, leading to degraded performance or a denial‑of‑service for network traffic. In environments using the vulnerable driver, the risk remains moderate.