In the Linux kernel’s VLAN QoS module, repeated cycles that set and clear egress priority mappings leave cleared entries in a hash table as tombstones, which accumulate until the device is torn down. This defect causes a memory leak that can grow until system memory is exhausted, potentially bringing the system to a halt. The flaw is a local resource exhaustion vulnerability that can be triggered by any process that modifies egress QoS settings on a Linux device.

All Linux kernel implementations before the patch that addresses the vlan_dev_set_egress_priority function are affected, regardless of kernel major version. No specific vendor product version is listed, so any kernel that contains the 8021q module without the fix is at risk.

The CVSS score is not provided, but the missing EPSS value and absence from CISA KEV indicate no known public exploits and a low to moderate probability of exploitation. The likely attack vector is a local or privileged user who can execute VLAN configuration commands or send traffic that triggers repeated set/clear cycles, leading to uncontrolled memory growth. The impact is confined to the host machine, producing a denial‑of‑service condition through memory exhaustion.