The vulnerability is a memory leak in the Linux kernel’s mlx5 HWS implementation. A replacement matcher is allocated and, if the resize-target setup fails, the matcher is never destroyed, causing a resource leak that can gradually consume kernel memory. This leak can lead to a denial‑of‑service condition if the kernel repeatedly encounters this failure scenario, potentially exhausting available memory and degrading system stability. The weakness is a classic memory‑management flaw.

All distributions of the Linux kernel that include mlx5 HWS support are potentially affected. The bug was observed in kernel version 6.13‑rc1 and remains present in 7.1.1, indicating that any kernel constructed with these drivers and not yet patched may contain the issue.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the attack model is unclear. Because the leak occurs in kernel mode, an attacker with sufficient privileges could trigger the failure path repeatedly, leading to memory exhaustion. The lack of a public CVSS score means the exact severity cannot be quantified, but the potential for denial‑of‑service warrants timely remediation. The likely attack vector is via local or remote code that can induce the resize‑failure condition in the mlx5 HWS context.