In the Linux kernel, the vfio/mlx5 driver uses non‑atomic bitfield operations that can race when modified concurrently by user space and kernel runtime handlers. The resulting inconsistent flag values can corrupt the internal status of the device, potentially causing erratic behaviour or service disruption. The patch relocates affected flags into dedicated storage units and tightens the struct layout to eliminate the race, ensuring that kernel state remains consistent during open, close, and reset operations.

All Linux kernel builds that include the vfio/mlx5 driver and have not applied the fix are affected. No specific version range is listed in the advisory, so any kernel containing the vulnerable code before the patch is vulnerable.

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits exist. A likely attack vector would require local privileged access or a malicious VFIO device provider capable of triggering the race through timing of user‑space operations. The overall risk to system stability is moderate but the threat of a critical exploitation is low.