The Mellanox mlx5e driver fails to synchronize its software DMA FIFO pointers on a transmit‑error recovery path. It resets only the consumer counter, leaving the producer counter pointing to stale entries. When the driver subsequently consumes entries, it attempts to unmap DMA pages that have already been released, producing the kernel warning observed and potentially triggering a fatal fault. This constitutes an instance of improper synchronization (CWE‑662) and improper locking (CWE‑821).

Affected systems are Linux kernel releases that contain the mlx5e network driver before the commit that removed the faulty dma_fifo_cc reset. This covers all kernel 6.x and earlier releases that ship the driver, including 6.13.0‑rc5 and earlier, as well as the 7.0‑rc1, ‑rc2, and ‑rc3 pre‑releases. The CNA vendors/products list identifies the affected product as Linux: Linux, so any system running a Linux kernel that contains the mlx5e driver before the fix is vulnerable.

The CVSS score is 8.2 and the EPSS score is < 1%, indicating a high severity but a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The component is part of the device driver layer, and exploitation would likely require a local or privileged user to induce a transmit error or otherwise trigger the queue‑recovery routine. The attack is expected to occur only when the driver encounters a TX error on a Mellanox network interface, making remote exploitation difficult without physical or privileged access.