In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue->txskb which gets freed without remorse nor checking. macbfreeconsistent() gets called in a few codepaths, but only close will trigger the added expressions. In macbopen() and macballocconsistent() failure cases, queues' tx_skb just got allocated and are empty.