In the Linux kernel, the function tun_xdp_one() incorrectly handles frames that are shorter than the Ethernet header length. When such a frame is processed, the function allocates a page but, instead of freeing it before returning an error, it leaks the page fragment. With each short frame processed, another chunk of memory is allocated and never released, which can quickly consume available RAM.

This flaw affects all Linux kernel releases that do not include the later patch that frees the page in the error path. According to the Common Platform Enumeration list, affected kernels include the 7.1 release candidates up to RC5; earlier stable releases are also vulnerable if the fix is not present. Any system that permits a local process to open /dev/net/tun and /dev/vhost-net and configure a tun/tap interface as a vhost‑net backend falls under this scope.

Based on the description, it is inferred that an attacker must have local write access to the tun and vhost‑net devices, which is typically available to any user on a machine with those devices exposed. The exploitation path involves repeatedly sending short frames to trigger the memory leak; a tight loop can exhaust host memory and cause an OOM panic. The EPSS score of less than 1% indicates a very low likelihood of mass exploitation, yet when it occurs it results in a severe local denial‑of‑service. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score of 7.1 and the potential for out‑of‑memory crashes make it a significant risk for systems that allow such local operations.