The kernel’s cortina Ethernet driver routine that processes received frames only subtracts from the NAPI budget when a frame is accepted. When errors occur, descriptors are still consumed without budget reduction. An attacker can send a stream of malformed packets to the interface, causing the driver to empty the receive ring in a single poll while counting each dropped frame as work. The resulting budget mis‑accounting forces the kernel to repeatedly schedule the device, draining CPU cycles and ultimately preventing normal traffic on the host.

All Linux kernel builds that contain the cortina driver code prior to the 2026‑97981 fix are affected. Because the patch does not apply to kernels that never shipped the cortina driver, only those deployments with such hardware should be evaluated. Administrators should check the exact kernel source tree at /drivers or the compiled kernel version. If the source tree includes the unpatched code, the host is vulnerable; any released kernel incorporating the change is safe.

Based on the description, it is inferred that the attack vector is remote network traffic directed at the cortina Ethernet interface. This issue is a resource exhaustion flaw identified as CWE-770. The vulnerability is not listed in the CISA KEV catalog and its EPSS score is <1%, while the CVSS score is 5.5. The possibility of disabling network service and consuming CPU resources can still have a high impact on system availability. Typical attackers would need no special privileges and could simply flood the interface, so the risk is considered high for exposed hosts.