The Atlantic driver inside the Linux kernel has a flaw where the deinitialization routine walks only a portion of the RX buffer ring when an interface is shut down. Unused buffers and their DMA mappings that lie in the unwalked region remain allocated, producing a memory and DMA leak every time an interface is taken down. Accumulated leaks can exhaust system memory and DMA resources, eventually leading to a denial‑of‑service condition.

Affected systems are Linux operating systems that contain the Atlantic Ethernet driver in the kernel. Any kernel build that includes the unchanged net/atlantic code before the patch is affected; the advisory does not list specific kernel versions, so administrators should verify whether their kernel incorporates the fix.

The CVSS score is not available and the EPSS score is unknown, so the exploit probability cannot be quantified. The likely attack vector involves triggering interface deinitialization, which typically requires privileged or local access to manipulate the driver via network traffic or to bring the interface down. Although it is not listed in the CISA KEV catalog, repeated exploitation could degrade system performance or force a reboot due to memory exhaustion.