A failure in the Linux kernel tun_xdp_one() function causes build_skb() to return an error without freeing the page that was allocated for the frame. Each such failure leaks one page-frag chunk from kernel memory, which over time can exhaust available memory and lead to a denial‑of‑service scenario. The impact is limited to loss of memory resources and does not provide direct code execution or access to secrets.

All Linux kernel builds that include the tun module and employ XDP for virtual networking are affected. Because the patch was applied in a later kernel commit, any kernel version prior to that commit is vulnerable; no specific version numbers are listed, so treat all earlier releases as susceptible.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so the publicly documented exploitation probability is unknown. The CVSS score is 5.5, indicating a medium impact primarily due to memory resource exhaustion. The likely attack vector is local privileged access or could be remote if an attacker can repeatedly trigger build_skb() failures via crafted XDP programs on tun interfaces.