The mlx5_ib driver in the Linux kernel allocates a transport domain during initialization. If enabling the load balancer fails, the driver does not deallocate the transport domain, resulting in a memory and resource leak. This leak can deplete RDMA context handles and destabilise the host, effectively causing a denial of service. The flaw also returns an unexpected value in the no‑loopback‑capability branch, which may confuse upper‑layer code and compound the resource exhaustion. The weakness is a classic memory‑leak failure.

The vulnerability resides in the Linux kernel’s mlx5_ib driver. Any system running a kernel version that contains the driver before the commit series referenced in the advisory (2c3b2667, 37fc3cc0, 65e34492, e7938911, f88e12c9) is affected. This includes mainstream distribution kernels that have not yet incorporated these commits into their stable releases. Systems that use InfiniBand loopback functionality or enable the mlx5_ib module are the ones most likely to encounter the failing path.

The EPSS score is < 1 %, and the issue is not listed in the CISA KEV catalog, indicating no widely known exploitation at this time. Based on the description, the likely attack vector is local with kernel‑level privileges; a privileged user or kernel module developer could repeatedly trigger the enabling failure path and exhaust system resources, leading to a denial of service. With a CVSS score of 7.8, the potential impact on availability is moderate‑to‑high. Because the attack vector is plausibly local and the exploitation likelihood is low, immediate patching is recommended for any host that requires InfiniBand loopback or runs an affected kernel.