In the Linux kernel’s InfiniBand mlx5 driver, a race condition existed when updating memory region (MR) registrations in implicit ODP configurations. The driver incorrectly allowed concurrent modifications to an MR’s parent key without rebuilding the entire key structure, leading to unsynchronized changes in the underlying pd fields. This flaw could result in inconsistent or corrupted memory registration states, potentially causing denial of service or privilege escalation if an attacker can trigger the race. The exact attack vector is not explicitly stated in the CVE description, so we infer that an attacker would need to construct concurrent operations on the same IB device to exploit this race condition.

All Linux kernel installations that include the mlx5 IB driver and use implicit ODP. The affected code paths reside in the mlx5 and ib subsystem; any kernel version before the fix is vulnerable regardless of architecture. The vendor information lists Linux as the affected vendor, meaning any distribution shipping the upstream kernel with the vulnerable code is impacted.

Because the flaw is a synchronization bug, exploitation requires the ability to perform concurrent operations against the same IB device. An attacker with executive or privileged access can craft multiple processes or threads that simultaneously modify or re‑register memory regions. The CVE description does not explicitly state the attack vector, but it is inferred that it involves concurrent manipulation of IB device memory registration. While no CVSS score or EPSS data are available, the presence of a race condition in kernel code is a high‑severity concern. The vulnerability is not currently listed in the CISA KEV catalogue, but its potential for causing kernel instability makes it a priority for remediation.