The Linux kernel’s ena network driver allocates a coherent DMA buffer for MMIO read responses during device probe. If the probe fails after this allocation, the buffer is never freed, resulting in a persistent memory leak. Based on the description, the likely attack vector involves a local attacker repeatedly triggering probe failures, exhausting kernel memory and causing a denial‑of‑service condition. The flaw is a classic resource‑exhaustion weakness involving an unreleased resource and a memory leak.

Any system running the Linux kernel with the ena network driver is affected. The vulnerability applies to all kernel builds before the commit that adds a destroy call to the probe error path. Linux distributions that ship the affected driver code without the patch are potentially vulnerable.

The CVSS score of 1.9 indicates low severity. The EPSS score is less than 1%, so the likelihood of exploitation is very low. The CVE is not listed in the CISA KEV catalog. Exploitation would require a privileged user or an attacker who can force a probe failure, such as by manipulating the attached device or its firmware; this privilege requirement is inferred from the need to trigger probe failures. Because the issue only manifests locally, widespread remote exploitation is unlikely. A local attacker can repeatedly trigger probe failures to drain kernel memory and cause a denial‑of‑service condition.