The flaw exists in the Linux kernel’s mlx5e network driver within the function mlx5e_tx_reporter_timeout_recover. After a channel teardown, the routine accesses a freed sq->netdev pointer, resulting in a read of kernel memory that was already released. This use‑after‑free can corrupt kernel data structures, potentially causing a crash or, in a worst case, enabling privilege escalation through memory corruption. The weakness is classified as CWE‑825.

All Linux kernel installations that use the mlx5e driver and have not yet applied the recent patch are affected. The specific kernel versions that lack the commit are not listed in the data, so any kernel that includes mlx5e and has not integrated the update should be considered vulnerable.

The CVSS score of 9.8 marks the vulnerability as critical, yet the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would generally require local access to trigger a channel teardown while the recover function is executing, which may pose a barrier to attackers. If successfully leveraged, the attacker could force a kernel panic or achieve elevated privileges via memory corruption.