The atlantic network driver in the Linux kernel contains a silent memory leak that occurs when a network interface is brought down under TX/XDP_TX load; stranded transmit descriptors that are not freed retain skb or xdp_frame references, preventing the page pool from shutting down and causing memory to be consumed until the system exhausts available memory, which can destabilize the kernel and affect overall system availability.

This issue affects Linux kernel installations that include the atlantic driver; specific version information is not provided in the CVE data, so all deployments of the driver during the period when the code change was removed are potentially impacted.

The vulnerability does not have an assigned EPSS score; it is not listed in CISA’s KEV catalog. Exploit requires triggering interface shutdown events or XDP detach actions under high TX load, which typically needs privileged access, but could be abused in environments where such actions are common. The resulting memory exhaustion can lead to denial of service, but the lack of remote code execution reduces overall threat level.