The RDMA mlx5 driver in the Linux kernel mistakenly frees the hardware‑provided Universal Address Register (UAR) index instead of the software‑managed index, creating a use‑after‑free condition that corrupts kernel memory and can trigger a system crash. This flaw represents an improper resource allocation or release vulnerability (CWE‑763). The impact is limited to denial of service through kernel instability; it does not provide code execution or data exfiltration capabilities.

All Linux kernel releases that compile the RDMA mlx5 driver with the unpatched code are vulnerable. The advisory does not list specific kernel versions, so any kernel that bundles the affected driver code before the patch is potentially impacted; administrators should compare their running kernel with the commit hash linked in the references

The CVSS base score of 7.8 reflects the severity of a kernel crash. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector requires local or privileged access to RDMA functionality or kernel privileges; a remote attack would need to leverage such privileges, which is unlikely in the typical environment. The risk is moderate but the high impact warrants timely remediation.