In the Linux kernel, the hip04 network driver fails to free receive buffers and DMA mappings when build_skb() fails during hip04_rx_poll(). The code proceeds to refill the slot with a new buffer, overwriting references and leaking the original resources. This resource leak can cause kernel memory exhaustion, degraded performance, or a crash, compromising availability. No evidence of higher‑privilege compromise or data disclosure is provided in the description. The flaw corresponds to Deallocation of Resources Without First Freeing them (CWE‑772).

The bug exists in any Linux kernel configuration that includes the hip04 driver prior to the patch that was introduced to fix the buffer leak. Consequently, all current kernel releases that ship the hip04 network driver are potentially affected until the kernel is updated. Particular attention should be paid to systems using earlier kernel versions that derived the driver from the time of the commit references provided.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of < 1% shows a very low probability of exploitation. The vulnerability is not in CISA's KEV catalog. The likely attack vector is local; it requires the ability to trigger build_skb() failures inside the driver, which would normally be limited to privileged users, kernel developers, or adversaries with root or hardware access. An attacker who repeatedly induces such failures could accelerate resource exhaustion, but remote exploitation through normal network traffic is not indicated by the description.