In the Linux kernel, the Mellanox mlx5 driver contains a bug where a work function can exit without signaling completion when a devcom error occurs. This omission can cause a caller waiting on the completion to block indefinitely, potentially leading to a kernel hang or degraded service.

The vulnerability exists in any Linux kernel that includes the mlx5 driver before the patch. Most modern distributions ship the driver in the upstream kernel, so many systems could be affected unless they have installed the recent kernel or applied the patch. Based on the driver name and file path, the issue appears to affect Mellanox mlx5 devices; this inference is drawn from the driver naming and is not explicitly confirmed in the vendor list, which only lists Linux:Linux.

The EPSS score of less than 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, so exploit prevalence remains low. The CVSS score of 5.5 indicates medium severity. The description does not specify an external trigger; it appears that a local action that causes a devcom error and triggers the missing completion will lead to blocking. Because the driver runs in kernel mode, an attacker would need sufficient privileges or physical access to send specific packets or manipulate hardware, making the risk primarily local unless remote code execution is already possible on the system.