In the Linux kernel, tun_xdp_one() fails to free a page allocated for frames shorter than ETH_HLEN, resulting in a memory leak. The leaked page fragments accumulate with each short frame processed, eventually exhausting memory and triggering an OOM panic. This flaw is a classic memory leak (CWE-763) that undermines system stability.

The vulnerability affects all Linux kernel versions prior to the patch that introduced proper page cleanup in tun_xdp_one(). It can be exercised by any local process that can open /dev/net/tun and /dev/vhost-net, attach a tun/tap device as the vhost-net backend, and send TX descriptors containing frames whose length minus the virtio-net header is below ETH_HLEN.

The exploit path is local: a user crafts a tight loop of short frames on a tun/tap interface connected to vhost-net, which repeatedly triggers the memory leak until the host runs out of memory and crashes. EPSS is not available, so the likelihood of exploitation is uncertain, but the impact is severe local denial of service. The vulnerability is not listed in the CISA KEV catalog, yet the absence of EPSS does not mitigate the risk of an OOM‑based DoS driven by ordinary user activity. The CVSS score is 5.5, indicating moderate severity.