A flaw in the Mellanox mlx5e driver resets only the consumer side of the DMA FIFO during a transmit‑error recovery, leaving the producer counter unchanged. When the driver resumes operation, it attempts to unmap DMA pages that were already unbound, causing kernel warnings such as "iommu_dma_unmap_page" and, in the worst case, a crash that brings the entire system down. This vulnerability therefore results in a denial‑of‑service condition through kernel instability rather than remote code execution.

All Linux kernel releases that include the mlx5e network driver are affected. The flaw existed in every build prior to the commit that removed the mistaken reset of dma_fifo_cc, including recent stable 6.x kernels. Systems running these kernels and currently operating mlx5e interfaces can experience the desynchronization during a transmit‑error scenario.

The CVSS score is 7.0, and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a local or privileged user to induce a transmit error or otherwise trigger the queue‑recovery path, which makes the threat moderate. The principal impact is a denial‑of‑service via kernel crash rather than remote code execution.