The Atlantic Ethernet driver in the Linux kernel contains a flaw in its deinitialization routine: it walks only the applied portion of the receive buffer ring, leaving buffers that were consumed but not yet reposted unvisited. The associated pages and their Direct Memory Access mappings therefore remain allocated. Over repeated interface shutdowns this leaks memory and DMA resources, which can eventually exhaust system resources and lead to a denial‑of‑service condition. This weakness is a classic case of CWE‑772: Unreleased Resource.

Systems running a Linux kernel that incorporates the net/atlantic driver but has not yet been updated with the reported patch are affected. The advisory does not enumerate specific kernel versions, so any build that includes the unchanged net/atlantic code is potentially vulnerable. Administrators should verify the kernel source or running version to confirm whether the fix is present.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to trigger interface deinitialization—typically achievable with privileged or local access to the target system—repeatedly to exhaust resources. Given the low probability score, the risk remains mitigated by routine patching rather than by immediate crisis responses.