The Linux kernel’s sxgbe network driver has a defect in the init_dma_desc_rings function. When an RX descriptor ring allocation fails, only the partially allocated RX rings are freed, leaving the previously allocated TX rings unreleased. This results in a kernel memory leak of DMA descriptor rings. If the failure occurs repeatedly, the accumulated leaked memory could exhaust kernel space and force the kernel to handle out‑of‑memory conditions, which would manifest as a crash or reboot of the host. The weakness is a memory leak, which is a form of resource exhaustion. The likely attack vector is the exploitation of a situation where the RX allocation fails, which could be caused by traffic load or by a deliberate resource denial to trigger the failure, though the CVE does not provide an explicit exploit.

All Linux kernel builds that incorporate the legacy sxgbe driver are potentially affected. Since no specific kernel release list was supplied, any distribution or custom kernel that includes the old driver prior to the patch is considered vulnerable until updated.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% signifies a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, meaning it has not been observed as a known exploit in the wild. A successful exploitation would require triggering repeated RX allocation failures, which an attacker could do if they can influence the network interface, but no publicly available exploits are documented.