A critical vulnerability in the Linux kernel gve driver allows an unauthenticated remote attacker to trigger a permanent network queue stall, resulting in a denial of service.

The vulnerability involves a flaw in the Rx buffer refill loop of the gve driver, where memory allocation failures under pressure prevent the NAPI subsystem from rescheduling. This leads to a permanent cessation of packet processing, which is an unauthenticated denial of service condition.

The inability to process network traffic results in a complete loss of connectivity for the affected system, directly impacting business continuity and service availability. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to production environments where the gve driver is utilized, as it can be triggered without any user interaction or authentication.

Immediate Action: Update the Linux kernel to version 5.15.216, 6.1.183, 6.6.151, 6.12.101, or newer to implement the starvation recovery timer.

Proactive Monitoring: Monitor network interface statistics for unexpected drops in packet processing or NAPI stall events in system logs.

Compensating Controls: Ensure system memory resources are sufficiently provisioned to mitigate extreme memory pressure, and implement network-level rate limiting to reduce the likelihood of triggering the buffer refill condition.

Public Exploit Available: Unknown

System administrators should prioritize the application of the provided kernel patches to all affected infrastructure running the gve driver. Given the potential for a permanent denial of service, testing and deploying the update across production environments is essential to maintain system stability and prevent service disruption.