The Linux kernel allows an unprivileged user in a user namespace to set the network device transmit queue length to an arbitrarily large value. Because several subsystems allocate ring buffers sized directly from this value, setting tx_queue_len to an overwhelming number causes the kernel to allocate millions of memory pages for skb arrays and pointer rings. The resulting out‑of‑memory conditions bring the host to a halt, allowing an attacker to cause denial of service. This vulnerability is an instance of unmanaged resource allocation (CWE‑770).

All Linux kernel releases before the patch that imposes the S16_MAX cap on tx_queue_len, including devices that use pfifo_fast, tun, tap, and other schedulers that rely on tx_queue_len. The issue manifests on systems that enable CONFIG_NET_SCHED, CONFIG_VETH, CONFIG_USER_NS, and CONFIG_NET_NS; any kernel that supports network namespaces and user namespaces can be affected until the upstream commit is applied.

The CVSS score is 5.5 and the EPSS score is <1%. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack vector requires only local access to the host and the ability to create a network namespace with the unshare command. By exploiting the unchecked tx_queue_len value, an attacker can exhaust system memory, trigger kernel OOM, and potentially crash the host. Because the escalation does not need elevated privileges, the risk is significant for local users, especially on multi‑tenant hosts or services that may run with untrusted code.