In the Linux kernel, the veth_poll() routine mistakenly derives the peer TX queue index from rq->xdp_rxq.queue_index, a field that is initialized only when an XDP program is attached. In a multi‑queue veth device with Generic Receive Offload enabled and no XDP program, this field defaults to 0 for every queue. Consequently, when the peer’s queue 1 becomes busy and stops, the poller continues to target queue 0, never waking the stalled queue. The driver also lacks a tx‑timeout handler, so the stalled queue remains blocked indefinitely, causing a denial of service on the virtual network link. This weakness corresponds to CWE‑1285.

All Linux kernel implementations that include the veth driver prior to the patch and are configured with multi‑queue veth interfaces and GRO enabled are affected. The CVE record does not specify particular kernel versions, so any kernel lacking the fix is potentially vulnerable.

The CVSS score of 7.5 and an EPSS score of < 1% indicate a moderate severity and a low chance of exploitation. Based on the description, it is inferred that the vulnerability is local and can be triggered by a local user or process that can create or manipulate veth interfaces and generate traffic that triggers back‑pressure. It is also inferred that remote hosts cannot directly influence the peer queue indices. Since the kernel does not invoke a watchdog timeout, the affected queue can remain stalled for an extended period, resulting in sustained denial of service for traffic on the veth pair.