A missing bit in the airoha driver's QDMA transmit queue cleanup routine causes DMA transmit descriptors to remain uncleared after a queue reset, and the TX index is not properly synchronized with the CPU index. While the kernel does not immediately crash, the NIC may incorrectly believe its transmit ring is full or that the queue is still in use, leading to lost or delayed packets and degraded network performance.

All Linux kernel releases that include the airoha network driver before the commit that adds the missing bits are affected. Distributions shipping a kernel older than the patched commit are therefore at risk until the kernel is upgraded or the patch is applied.

The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, indicating a low likelihood of exploitation. The likely attack vector is the triggering of the cleanup logic when packets are transmitted or when the driver is reset, which could be induced by sending traffic over the affected interface or by a local user with sufficient privileges. Based on the description, the primary impact includes network performance degradation or temporary loss of transmit capability rather than remote code execution.