The kernel module mlx5e handles traffic control for Mellanox NICs. A flaw in the flow deletion routine caused the ESW devcom lock to be acquired without first verifying whether the flow was a peer flow. When __mlx5e_add_fdb_flow() fails or is called while the devcom component lock is held, this unguarded acquisition re‑enters the same lock, leading to an accidental recursive lock acquisition. The result is a deadlock that can halt all operations that rely on the networking stack, effectively denying service. The weakness can be mapped to the deadlock CWS, specifically CWE‑754.

All Linux kernels that include the mlx5e module and have not applied the patch are affected. The CVE does not list specific version ranges, so any kernel that contains the unpatched mlx5e code may be vulnerable.

With no EPSS score available and the issue not catalogued in CISA's KEV list, no published exploit evidence exists. The internal deadlock can be triggered by normal traffic control configuration or by low‑level NIC errors. Because the weakness resides in kernel code, it requires local access by a privileged user to reconfigure flow tables, and an attacker with such privileges could deliberately cause the deadlock. The CVSS score is not provided, and the risk is primarily operational disruption rather than data compromise.