During periods of extreme memory pressure, the Linux kernel's GVE driver may fail to allocate receive buffers when refilling its queue. If the number of posted buffers drops below a critical threshold, the driver stalls: no packets are delivered, no Rx completions are generated, and the NAPI handler is never rescheduled. This results in a permanent queuing stall that eliminates all traffic on the affected interface and effectively denies service.

The flaw is present in any Linux kernel that includes the GVE driver before the introduction of the starvation recovery timer. All upstream Linux releases that ship without the patch and any downstream distributions that incorporate the unpatched GVE driver are vulnerable. The vulnerability is specific to the GVE virtual network interface but can impact any host that relies on it for connectivity.

The CVSS base score of 7.5 denotes a high severity threat, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local memory exhaustion; a privileged or compromised local user could drain system memory to trigger the allocation failure and stall the queue, leading to a denial‑of‑service of the network interface.