In the Linux kernel's ice driver, the pf->txtime_txqs bitmap is indexed by queue number without verifying the VSI type. During a PCI reset rebuild, the controller's CTRL VSI ring mistakenly interprets a bit set for a PF VSI queue as enabled ETF, causing the driver to allocate a timestamp ring for a queue that has no net device. Because the cleaning path for the timestamp ring performs an early return when no net device is present, the allocation is never freed, resulting in a 64‑byte memory leak on every PCI reset. This resource exhaustion can accumulate over time and compromise kernel stability.

The flaw resides in the Linux kernel's ice driver, which implements networking for Intel Ethernet controllers. All Linux distributions that ship kernel versions before the patch that adds the VSI-type check are potentially affected. The affected code operates during PCI reset or any reconfiguration of the driver’s transmit queues.

The CVSS score is 5.5 and the EPSS score is less than 1 %, suggesting a moderate severity but a low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. The attack requires privileged access to trigger repeated PCI resets or power cycling of the affected device, which is why the attack vector is inferred as local. Because the leak is small but cumulative, the risk of resource exhaustion is only significant in environments with frequent resets or limited memory capacity.