The vulnerability occurs in the Linux mlx5 driver when querying the MCIA register. The register can supply up to 128 bytes, but the driver structure only allocates space for 48 bytes. When the driver copies the register contents into this insufficiently sized buffer, it may read beyond the buffer’s bounds, triggering a kernel BUG. This kernel over‑read can corrupt memory and lead to a kernel panic, resulting in a loss of service for the system. The bug is only exposed when an application reads the MCU using ethtool or a privileged userland utility that accesses the device. No direct escape to higher privileges or data leakage is documented in the advisory.

The flaw resides in the Linux kernel’s mlx5 networking stack and affects any Linux system that includes the mlx5 driver with the mcia_32dwords capability. The affected kernel package is not version‑specific in the advisories; therefore all kernels containing the legacy mlx5 driver are potentially vulnerable until the fix is applied.

The CVSS score of 7.1 indicates a medium severity vulnerability. The EPSS score is < 1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so public exploitation evidence is lacking. The attack is likely to require privileged access via ethtool or other privileged userland utilities that query MCIA registers. Once executed, the kernel handles the overflow with a BUG, which typically leads to a system crash and loss of availability. Although the exploitation conditions are not trivially met, the impact of a successful exploit is high, warranting immediate remediation.