The Mellanox mlx5e driver, when processing a transmit error completion queue entry, resets only the consumer counter of a software DMA FIFO but leaves the producer counter unchanged. When recovery continues, the driver uses the old producer position and attempts to unmap DMA pages that were already released. This produces kernel warnings such as "iommu_dma_unmap_page" and can lead to an unhandled fault, resulting in a kernel crash. The attack surface is limited to the device driver, so a local or privileged user would need to trigger a transmit error or otherwise force the recovery routine. Based on the description, it is inferred that an attacker would have to provoke such a condition, likely through privileged network configuration or by exploiting a vulnerability that causes excessive transmit errors on a Mellanox NIC.

Affected systems are Linux kernel releases that include the mlx5e network driver before the commit that removed the defective dma_fifo_cc reset. This covers all kernel versions available from vendor distributions that ship kernel 6.x and earlier, including the 6.13.0-rc5 and earlier releases, as well as the 7.0‑rc1,‑rc2, and ‑rc3 pre‑releases. The CNA vendors/products list identifies the affected product as Linux: Linux. Therefore any system running a Linux kernel that contains the mlx5e driver before the fix is vulnerable.

The CVSS score is 8.2 and the EPSS score is < 1%, indicating a high severity but a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The component is part of the device driver layer, and exploitation would likely require a local or privileged user to induce a transmit error or otherwise trigger the queue‑recovery routine. The attack likely occurs only under conditions where the driver encounters a TX error on a Mellanox network interface, making remote exploitation without physical access or kernel privilege difficult.