In the Linux kernel driver txgbe, forwarding‑directed (FDIR) filter entries added while the interface is down are not removed when the device is taken away while the interface remains up. The driver’s remove routine skips cleanup of the filter list, resulting in a leak of memory and driver state. Although the defect does not grant an attacker remote code execution or privilege escalation, repeated removal of the interface could exhaust system memory and degrade overall kernel stability.

All Linux kernel builds prior to the inclusion of the patch that addresses CVE‑2026‑68321 are affected. The bug is limited to the txgbe driver, which implements a 10 Gigabit Ethernet controller. No specific kernel version numbers are listed, but any kernel that contains the legacy txgbe driver code without the fix is vulnerable.

No EPSS score is available for this vulnerability and it is not listed in CISA’s KEV catalog. The CVSS score is not provided in the data. The likely attack vector involves a local attacker who can trigger driver removal while the network interface remains up, which is inferred from the fact that the bug only manifests during driver removal when the device is still active. Based on the description, it is inferred that the flaw could lead to resource exhaustion but does not provide a path for remote code execution or privilege escalation. The risk level is therefore low to moderate, primarily affecting resource availability rather than confidentiality or integrity.