The ENA network driver in the Linux kernel allocates XDP transmit queues before establishing the standard transmit path. If the subsequent allocation of regular TX queues fails, the cleanup code does not tear down the partially created XDP queues, leaving orphaned kernel allocations. This resource leak can accumulate over time, increasing kernel memory consumption and exhausting queue descriptors. The description implies that repeatedly triggering the failure path could be exploited to deplete kernel resources, but the exact exploitation method is not explicitly documented, so this is inferred from the observed behavior.

All Linux kernel builds containing the ENA driver before the fix, specifically mainline releases v6.13‑rc1 through v7.1‑rc7 and any derivative distributions using those kernels with an ENA‑compatible NIC, are impacted. Every vendor that ships a kernel from this range without the corresponding patch would expose affected hosts to the leak.

The CVSS score of 5.5 indicates moderate severity; the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require a local or privileged attacker able to induce repeated allocation failures, implying that the risk is mainly operational as opposed to giving remote code execution. It is prudent to apply the patch promptly to mitigate the resource exhaustion risk.