A race condition in the Linux mlx5 RDMA driver causes the kernel to wait indefinitely for a User‑Mode Registration (UMR) completion while unloading a device in Link Aggregation Group (LAG) mode. Because the bond device only sees the master and not the slave, the completion never arrives, resulting in a driver hang that can freeze the entire system. This vulnerability illustrates an improper synchronization flaw (CWE‑833).

All Linux kernels containing the mlx5 driver when LAG bonding is enabled are potentially affected, regardless of distribution. No specific kernel release is listed, but any kernel prior to the commit that adds a sys_error notifier to the mlx5 driver is vulnerable. The vulnerability exists in the kernel’s RDMA subsystem and is unrelated to vendor-specific patches.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is < 1% (≈0.00155). The vulnerability has not been listed in the CISA KEV catalog. Based on the description, the attack vector appears to be local, requiring the attacker to trigger a firmware reset or otherwise cause the driver to unload a device in LAG mode. Successful exploitation would lead to a system-wide denial of service by freezing the kernel. While remote exploitation is not documented, local privilege escalation or a compromised RDMA device could enable the conditions for exploitation. The risk is therefore primarily availability risk with a moderate severity posture.