A race condition in the Linux mlx5 RDMA driver causes the kernel to hang indefinitely when a device in Link Aggregation Group (LAG) mode is being unloaded after a firmware reset. The hang occurs while the driver waits for User-Mode Registration (UMR) completion; because the slave bond device is not registered on the master, the completion never arrives, locking up the kernel. This leads to a denial‑of‑service condition on the affected host.

The flaw resides in the Linux kernel’s mlx5 driver, affecting all distributions that ship this driver when LAG bonding is enabled, regardless of vendor. No specific kernel release is listed, but any kernel containing the mlx5 implementation before the fix is susceptible. The patch is integrated into the kernel’s stable tree and referenced by the provided kernel commit links.

The vulnerability carries high availability risk because it can freeze the entire system. Attackers would need preliminary control of the kernel or the ability to trigger a firmware reset on a device in LAG mode; the data does not confirm a remote attack vector, so the primary risk is local. EPSS information is unavailable and the flaw is not in the CISA KEV catalog, but the nature of the kernel hang justifies a high severity posture. The fix adds a sys_error notifier to ensure error events propagate during teardown, preventing the hang.