The vulnerability resides in the GVE (Generic Virtual Ethernet) driver of the Linux kernel. When a ring is stopped, the driver fails to release XSK buffers that were posted to the NIC. The unreleased buffers accumulate over time, leading to a memory leak. This could cause the kernel to exhaust the memory reserved for these buffers, potentially triggering out‑of‑memory conditions or kernel panics and interrupting system availability.

This bug affects Linux kernel deployments that include the GVE (Generic Virtual Ethernet) driver. Any distribution or custom kernel using the GVE module and its NIC integration without the patch is susceptible. The exact kernel versions are not specified, so any release prior to the fix should be considered vulnerable.

The impact is primarily local availability loss; the issue does not involve code execution or privilege escalation, and it carries a CVSS score of 2.3 indicating low severity. An attacker would need the ability to stop or reset a GVE ring—perhaps through driver control or induced traffic patterns—to trigger the leak. No public exploitation has been reported, and the EPSS score is < 1%, so the probability of attack remains uncertain but the resource‑exhaustion DoS scenario remains a realistic concern for affected systems.