The flaw in the Linux kernel’s mlx5 RDMA driver allows a failure path in ODP populate to bypass the cleanup that unmaps and frees an XLT buffer. This results in a retained DMA mapping, a leaked memory buffer, and in some cases a permanently locked mutex. The net effect is a memory and kernel resource leak that can gradually exhaust system resources, potentially leading to a denial of service. The weakness is a memory management error, corresponding to CWE-772.

The issue affects the Linux kernel’s mlx5 RDMA implementation that uses ODP populate for XLT buffer management. All kernel versions that employ this driver and pathway before the patch are vulnerable. No specific version list is provided, so the vulnerability is considered present in unpatched kernels.

The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no current widespread exploitation. Based on the description, the likely attack vector is local or requires elevated privileges to trigger the ODP populate path. The CVSS score of 7.5 indicates a high severity, and the potential for resource exhaustion suggests a moderately high risk if the vulnerable configuration is used.