The vulnerability resides in the Linux kernel’s igc network driver. When igc_fpe_init_tx_descriptor fails, the allocated socket buffer (skb) is not freed, resulting in a memory leak that remains in kernel space. This uncontrolled resource consumption can gradually exhaust available memory, causing out‑of‑memory events or a system crash, effectively rendering the system unavailable. The weakness is a classic unreleased resource flaw, classified as CWE‑772.

All Linux kernel builds that include the igc driver and have not applied the patch commit c3ebf0565 are impacted. No exact kernel version range is listed, so any kernel containing the igc driver prior to this fix could be vulnerable. The patch was validated on a system with an Intel I226 Ethernet adapter using ethtool to force the error path, indicating that any configuration that exercises the vulnerable code path may affect the host.

The CVSS score of 5.5 indicates moderate risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not featured in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to trigger the failure path in the igc driver, which likely requires local or privileged access, for example by using ethtool or manipulating packet transmission. Repeated exploitation could exhaust kernel memory and induce a denial‑of‑service.