Technical impact
The Linux kernel’s VLAN QoS driver contains a flaw where vlan_dev_set_egress_priority retains cleared egress priority entries as tombstone nodes in a hash table. Repeated cycles of setting and clearing distinct packet priorities lead to an unbounded accumulation of these tombstones, gradually exhausting available memory. When the system memory is depleted, the kernel is forced to crash or reboot, resulting in a denial‑of‑service condition for all services running on the host. Based on the description, it is inferred that an attacker must be able to modify VLAN egress QoS settings—a task that typically requires local or elevated privileges on the system.
Affected Systems
All Linux kernel versions before the commit that removes the tombstone handling (commit 7dddc74) are affected. This includes mainstream releases such as the 2.6.12 series and any derivative kernels that ship the 8021q driver without the cleanup logic. Systems running these kernels and exposing the VLAN QoS interface are vulnerable.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% reflects a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires local or privileged access to configure VLAN egress QoS; an attacker who can perform such configuration changes can repeatedly trigger the memory leak, leading to gradual exhaustion of kernel memory. Because the flaw is local and does not rely on external network exposure, it cannot be remotely leveraged without first obtaining privileged access.
Ubuntu USN