The Linux mlx5 driver incorrectly tracks page fragment counts when XDP programs use bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The bug causes a negative reference count on a page pool page, potentially leading to a kernel panic and denial of service. This is a memory management flaw that can crash the system when malicious or faulty XDP code is executed.

The vulnerability affects any Linux kernel that includes the mlx5e driver, particularly on devices using the mlx5 or mlx5e network driver. The issue exists regardless of the specific kernel release, as long as the driver is compiled with the faulty fragment counting logic; however no explicit version impact list is available.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the vulnerability has a CVSS score of 7.0, indicating moderate to high severity for a kernel crash via reference counting, implying a significant impact should it be exploited. The likely attack vector is local or via a compromised network path that can execute XDP programs; an attacker with access to run XDP code on a device that uses the mlx5 driver could trigger the crash. Because the bug manifests only when a program alters the XDP buffer layout, exploitation requires an attacker to control or influence XDP code execution, making the risk moderate to high for systems that host untrusted XDP programs.