EUVD-2026-108841
GHSA-fx6x-79c6-q94v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach gve NIC path with AF_XDP zero-copy enabled
-
ExploitInduce error-flagged RX completion descriptors
-
ExecutionLeaked XSK buffers accumulate unfreed
-
ImpactBuffer pool exhausted, service degraded/denied
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the host to be using the gve (Google Virtual Ethernet) driver with AF_XDP zero-copy (ZC) sockets configured on the RX path - not a default configuration. The leak is triggered only when the error bit is set in an RX completion descriptor; in that path the buf_state and attached XSK buffer are not freed. Limiting factors: the gve driver is specific to Google Cloud environments, AF_XDP ZC must be explicitly set up, and the available sources do not describe whether or how an external attacker can deterministically cause error-flagged RX descriptors - so attacker-controlled triggering is unverified. Impact accrues gradually as leaked buffers accumulate. |
| Impact | Signals point to a moderate, not urgent, priority. The input CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is availability-only - there is no confidentiality or integrity impact - so this is a denial-of-service-class resource leak, not a data-exposure bug. The EPSS score is low at 0.21% (10th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit is identified. The vuln.today decision label is 'this_week', which argues for patching within the normal fast cycle rather than as an emergency. The CVSS AC:L is questionable against the description: the leak occurs only when the error bit is set in an RX completion descriptor while AF_XDP zero-copy is in use, and the available sources do not describe how an attacker would reliably force those error descriptors - so network-vector, low-complexity exploitation should be verified rather than assumed. Note also the 'Information Disclosure' tag directly conflicts with the CVSS impact (C:N, A:H only); this is a buffer/resource leak causing availability loss, not information disclosure. |
| Exploit ScenarioDerived | An actor able to influence traffic to a Linux host running the gve (Google Virtual Ethernet) driver with AF_XDP zero-copy enabled could cause RX completion descriptors to be marked with the error bit; each such descriptor leaks an XSK buffer that is never freed, and sustained occurrence gradually exhausts the buffer pool and degrades or denies service. No public exploit code is identified, and the sources do not describe how the error bit is driven, so reliable remote triggering is unproven. The impact is limited to availability - there is no code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Memory is leaked in the Linux kernel's gve (Google Virtual Ethernet) driver when an RX completion descriptor arrives with the error bit set while AF_XDP zero-copy sockets are in use: the buf_state and its attached XSK buffer are never freed, so leaked buffers accumulate over time. Only hosts running the gve driver - which is specific to Google Cloud environments - with AF_XDP zero-copy configured on the RX path are exposed, so this is not a default configuration, and the sources do not show how an external party could deterministically force error-flagged RX descriptors. Available scoring is mixed: the published CVSS 3.1 vector claims 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) while the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting gradual resource exhaustion rather than a hard availability hit; EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: the fix is in Linux 6.18.57, 7.2.11 and 7.3 (stable commits 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e, 889f763874855c575429f75946132a53c573aa14 and 06656aaa7e43ae62b673c2244d27099b8b94a70d, referenced from https://git.kernel.org/stable/c/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e and the sibling links); update the guest kernel to the fixed build for the branch in use, since the vulnerability is resolved only by the kernel change and the supplied data describes no separate userspace or driver-side workaround. For hosts that cannot be updated immediately, the compensating control implied by the trigger conditions is to avoid AF_XDP zero-copy sockets on gve RX interfaces - bind XSK sockets in copy mode or keep AF_XDP off the gve interface entirely - which removes exposure to the leaking error path at the cost of the zero-copy performance benefit those workloads were using; note that this only prevents new leaks and does not reclaim buffers already lost. Because impact accrues gradually rather than instantly, scheduling can follow the 'this_week' priority reflected in the decision signal and the low EPSS (0.21%), and environments that must run AF_XDP ZC on gve in the interim should watch UMEM/buffer availability and be prepared to reset or recreate the XSK setup if memory pressure builds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The gve driver provides the virtual NIC used by Google Compute Engine instances. The flawed path is the RX completion descriptor ring: when the descriptor's error bit is set, the driver is expected to release the buf_state together with the buffer attached to it. In the AF_XDP zero-copy (ZC) configuration, the buffer is an XSK buffer backed by a user-space UMEM region registered through an XDP socket, and in this error path that XSK buffer was not returned to the pool, producing an unreleased-resource/memory-leak condition (no CWE identifier is assigned in the supplied data). Because the leak occurs on the error completion path rather than the normal datapath, its practical effect depends on how often error-flagged received descriptors occur; the supplied sources do not describe a mechanism by which an attacker can control that rate. Effects are cumulative - freed-page accounting and UMEM availability degrade as leaked buffers pile up, with availability impact assessed as partial (A:L) rather than total. The fix is a kernel-side change to free the omitted object in the error branch, delivered through the stable trees.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trigger needs AF_XDP zero-copy config plus an error-flagged RX descriptor whose cause is undescribed (AC:H); gradual buffer leak gives limited availability loss (A:L) with no C/I impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
gve: fix XSK buffer leak on error descriptor
When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak.
This issue was caught by LLM.
Executive ViewAI
A memory leak in Google Cloud's virtual Ethernet driver (gve) can gradually exhaust memory on affected hosts, potentially degrading or disrupting services. Only a small subset of systems using AF_XDP zero-copy on the receive path are exposed, limiting overall organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB