A failure in the Linux kernel tun_xdp_one() function causes build_skb() to return an error without freeing the page that was allocated for the frame. Each such failure leaks one page-frag chunk from kernel memory, which over time can exhaust available memory and lead to a denial‑of‑service scenario. The impact is limited to loss of memory resources and does not provide direct code execution or access to secrets.

All Linux kernel builds that include the tun module and employ XDP for virtual networking are affected. The provided CPEs reveal that versions 7.1 rc1 through rc5 are affected, so any kernel prior to the patch commit including these releases is vulnerable. Kernels newer than the patch commit are not affected.

The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, so publicly documented exploitation probability remains very low. The CVSS score is 7.1, indicating a high impact primarily due to memory resource exhaustion. The likely attack vector is local privileged access or could be remote if an attacker can repeatedly trigger build_skb() failures via crafted XDP programs on tun interfaces.