In the Linux kernel, the Mellanox mlx5 driver for Link Aggregation Group (LAG) devices can create a debugfs interface even when the LAG context is missing. When the initialization function _mlx5_lag_dev_add_mdev() mistakenly reports success after an internal error, the subsequent mlx5_ldev_add_debugfs() call creates a debugfs directory and attributes that expect a valid device pointer. A null pointer dereference may occur if an attacker accesses these malformed files, leading to a kernel crash and denial of service. This flaw is a direct result of a null‑pointer dereference (CWE‑476) and unchecked return value handling (CWE‑824).

This behavior exists in all Linux kernel releases that include the mlx5 LAG driver prior to the patch, covering the current 6.x and 7.x series as well as the 7.0 release candidates 1 through 6. The affected product is the Linux kernel and any derivative builds that ship the net/mlx5 module without the fix.

The CVSS base score of 5.5 indicates moderate severity. The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, implying limited exploitation activity. Based on the description, it is inferred that an unprivileged local user could read or write the exposed debugfs entries, providing a local attack vector. A kernel crash could be triggered by accessing the malformed debugfs entries, but it does not provide a clear path to privilege escalation or remote code execution.