The bug is due to an off‑by‑one error in the rollback loop of mlx5_lag_create_single_fdb() within the Linux kernel. On failure at index i, the loop incorrectly starts the cleanup from i, causing the failed entry to be rolled back and potentially operating on uninitialized memory or double‑tearing a rule that had already been self‑rolled back. This corruption can trigger a kernel panic or lead to a denial of service.

All Linux kernel releases that include the mlx5 network driver with LAG support are affected. No specific version ranges are published; any kernel that has not integrated the patch commits 0f0e4ae6 or 40cc06bf may be vulnerable. System administrators should verify the kernel version and commit history to determine exposure.

The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score of < 1% suggests a very low likelihood of exploitation. The bug is not listed in the CISA KEV catalog, indicating no confirmed public exploits. The description does not detail how the error is triggered; the off‑by‑one slip in the rollback loop could lead to kernel memory corruption, potentially causing a panic or denial of service if exercised. Because the bug can result in critical kernel state corruption, it warrants immediate attention until a patch is applied.