A bug in the Linux kernel bcmgenet driver caused the driver to omit returning dropped transmit frames to the free buffer descriptor pool during queue reclaim. As a result, buffer descriptors are leaked and the pool gradually empties, leading to a loss of network transmit capability and eventual service interruption for the host. The weakness is a resource exhaustion flaw, as evidenced by the commit that restores the descriptors to the free pool.

All Linux kernel builds that include the bcmgenet driver without the commit identified by the referenced series are affected. This includes broadcom Ethernet hardware using the bcmgenet module in any kernel version prior to the application of the patch. The exact version range is not listed, but all kernels that compiled bcmgenet before the history commits are susceptible.

The vulnerability has no defined CVSS or EPSS score, and it is not listed in the CISA KEV catalog. The most likely attack vector is local: a process or user with kernel module interaction privileges could generate high levels of traffic to trigger the descriptor leak, leading to a local denial‑of‑service. No documented exploits are known, but the potential for resource exhaustion makes the issue serious if exploited.