An error path in the mlx5 RDMA driver causes the SRQ initialization routine to drop a prefix on failure: the second SRQ is freed but its pointer is still stored in the device structure. Subsequent fast‑path checks treat this dangling pointer as a valid SRQ, and later code dereferences it or frees it again, producing a classic use‑after‑free and double‑free scenario that corrupts kernel memory.

This vulnerability applies to all Linux kernel releases that include the RDMA mlx5 driver before the commits cited in the references. Any system running an unpatched kernel with that driver compiled in is susceptible; the specific kernel version is not tied to a single release because the flaw is discovered in the source code rather than a particular build.

The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.8 assigns it a medium‑to‑high severity rating. While the CVE description does not assert that a successful exploit results in privilege escalation or denial of service, the nature of the flaw—kernel memory corruption through a use‑after‑free and double‑free—could lead to a kernel crash or allow an attacker with sufficient local or RDMA‑based access to corrupt memory and potentially execute arbitrary code. Based on the description, it is inferred that the likely attack vector is a privileged local user who can create SRQs. The precise feasibility of exploitation remains unspecified in the provided data.