CVE-2026-23453: Add CVSS 3.1 score (7.5 HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AV:N -The vulnerable path is native RX packet processing in the TI
    ICSSG Ethernet driver, reached by packets arriving on the network
    interface. In a reasonable XDP firewall/drop deployment, a remote
    sender can supply packets that the installed XDP program drops.
AC:L -Once the interface is running with a non-zero-copy XDP
    program that returns XDP_DROP, triggering the leak only requires
    sending matching packets. There is no race, timing window, or
    fragile memory-layout dependency.
PR:N -The attacker does not need to load or attach the XDP program
    in the highest-impact scenario; the target is already configured
    with an XDP drop program. The triggering packets can be
    unauthenticated network traffic.
UI:N -No victim user action is required during exploitation. Packet
    receipt and NAPI RX processing occur automatically on the running
    interface.
S:U -The impact remains within the same kernel and host security
    authority. This is not a VM escape, IOMMU bypass, or cross-scope
    boundary violation.
C:N -The bug is an unrecycled page-pool buffer leak on XDP_DROP,
    not an out-of-bounds access, use-after-free, or information
    disclosure. No attacker-readable data is exposed by this flaw.
I:N -The leak does not corrupt memory or provide a write primitive.
    It only loses references to RX pages that should have been returned
    to the page pool.
A:H -Each dropped packet in the affected mode can permanently leak
    a page, and sustained unauthenticated traffic can drive the system
    into OOM. On embedded or network-gateway deployments this can cause
    loss of service, process termination, watchdog reset, or system
    unavailability.

Signed-off-by: Sasha Levin <sashal@kernel.org>