A NULL pointer dereference occurs in the mlx5e traffic-control driver when TC steering flows are deleted, causing a kernel Oops and crash. The fault arises because the driver’s routine attempted to iterate over all possible port numbers instead of only those currently present, resulting in the driver touching non-existent peers. The crash produces a system-wide denial of service that interrupts all network traffic managed by the affected driver.

Linux kernels that contain the unpatched mlx5e driver—including 6.18 and all subsequent releases that have not incorporated the fix—are impacted. The CPE list shows Linux 6.19 release candidates (rc1-rc7) as affected, meaning any system running those versions or later with the buggy driver is at risk. Systems with Mellanox (mlx5) Ethernet adapters and the traffic-control steering module are the only ones that can be affected.

Based on the description, it is inferred that the likely attack vector is local manipulation of traffic-control settings, for example using the 'tc' command or an application that modifies TC flows, which triggers the kernel crash. The CVSS score of 5.5 indicates moderate severity, and the EPSS probability of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the fault requires interaction with the driver’s internal data structures and no remote or privilege-escalation vector exists, the impact is confined to a kernel crash that results in a system reboot or service interruption.