The mlx5 networking driver in the Linux kernel contains a flaw that triggers a crash when a device that lacks IPsec support is switched to switchdev mode. The driver incorrectly attempts to clean up IPsec resources that were never allocated, resulting in an invalid memory dereference and a kernel panic. The crash leads to a complete loss of system availability for the affected host.

All Linux kernel installations that include the unpatched mlx5 driver are vulnerable. The CVE data does not specify which kernel releases contain the fix, so administrators should review release notes or vendor advisories to determine if their current kernel includes the updated driver code that prevents the crash during switchdev transitions.

The vulnerability creates a local denial‑of‑service condition. Based on the description, it is inferred that an attacker would need privileged or system configuration rights to perform the switch to switchdev mode on a non‑IPsec device. Its CVSS score of 5.5 indicates moderate severity, while an EPSS value of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Because it does not allow remote code execution, the threat remains confined to availability disruption on the affected system.