In the Linux kernel driver txgbe, forwarding‑directed (FDIR) filter entries added while the interface is down are not removed when the device is taken away while the interface remains up. The driver’s remove routine skips cleanup of the filter list, resulting in a leak of memory and driver state. Although the defect does not grant an attacker remote code execution or privilege escalation, repeated removal of the interface could exhaust system memory and degrade overall kernel stability.

All Linux kernel builds prior to the inclusion of the patch that addresses CVE‑2026‑68321 are affected. The bug is limited to the txgbe driver, which implements a 10 Gigabit Ethernet controller. No specific kernel version numbers are listed, but any kernel that contains the legacy txgbe driver code without the fix is vulnerable.

An EPSS score of less than 1% is recorded for this vulnerability, indicating a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. The CVSS score is 4.1. The likely attack vector involves a local attacker who can trigger driver removal while the network interface remains up, which is inferred from the fact that the bug only manifests during driver removal when the device is still active. Based on the description, it is inferred that the flaw could lead to resource exhaustion but does not provide a path for remote code execution or privilege escalation. The risk level is therefore low to moderate, primarily affecting resource availability rather than confidentiality or integrity.