The mlx5 driver in the Linux kernel tracks page fragment counts incorrectly when XDP programs use bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). When an XDP program reconfigures the buffer layout and drops tail fragments, the driver fails to decrement the reference count for the discarded fragment, leaving the page pool page with an inconsistent reference count. Based on the test output, it is inferred that the negative reference count could lead to a kernel crash, potentially disabling the system.

Any Linux installation that includes the mlx5e network driver is affected. The flaw is present in all kernel versions that contain the buggy fragment‑counting logic; no specific release list is supplied, but the issue existed at least through kernel 6.18.0‑rc7. It applies to all devices that use the mlx5 driver for RDMA/InfiniBand over the mlx5 interface.

The EPSS score of <1% indicates a very low likelihood of exploitation, and the vulnerability is not cataloged in the CISA KEV. The CVSS score of 9.8 highlights a severe kernel crash that could lead to a denial of service. Exploitation requires the presence of an XDP program that modifies the buffer layout via bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). Based on the description, it is inferred that such programs must be executed on the affected system; this typically implies either local or privileged access, or a trusted network path that can run XDP code. Because the bug is triggered only when the buffer layout is altered, attack scenarios are limited to environments that host malicious or untrusted XDP programs.