A reference count leak was identified in the Linux kernel’s Mellanox mlxsw switch driver. The flaw occurs when the function that joins a link aggregation group fails: the reference obtained for the LAG is not released, causing the count to grow indefinitely. This flaw could allow an attacker to consume kernel resources over time, although no direct code execution is possible.

All Linux kernel builds that include the Mellanox mlxsw switch driver before the recent patch. The affected code paths are mlxsw_sp_port_lag_join, mlxsw_sp_port_lag_index_get, and mlxsw_sp_lag_get. The issue exists in any distribution kernel that compiles and uses the mlxsw driver on physical or virtual machines.

The CVSS score of 5.5 reflects moderate severity, and the EPSS score of < 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog and no publicly available exploits exist. An attacker would need to trigger the error path in the mlxsw_sp_port_lag_join function, which requires kernel access, making it difficult to exploit remotely from unprivileged contexts.