A vulnerability in the Linux kernel’s gve driver caused the XSK buffer to not be freed when an error bit was set in the RX completion descriptor. The resulting memory leak could accumulate over time, exhausting system resources and potentially causing a denial-of-service condition. The flaw is a classic memory management issue that allows the kernel to retain buffers that should be reclaimed, which may degrade performance or trigger crashes if the memory pressure becomes severe.

The vulnerable component is the Linux kernel’s gve driver used in AF_XDP Zero Copy support. No specific kernel version ranges are listed, so any deployments using recent gve functionality may be impacted until the fix is applied. The vendor is the Linux community.

The CVSS score of 7.5 and the EPSS score of < 1% indicate a high severity but a low probability of exploitation, which limits quantitative risk assessment. However, the defect is a kernel memory leak that could be triggered by malformed or malicious network traffic against the AF_XDP interface. An attacker could craft RX completion descriptors that set the error bit, forcing the kernel to leak memory. Since the vulnerability operates within kernel space, exploitation requires the attacker to have sufficient privileges to influence network traffic, but the impact level remains high once triggered. The issue is not listed in the CISA KEV catalog, indicating that no public exploits are known or reported at this time.