The defect originates in the Linux mlx5e driver where the representor vnic devlink health reporter is created and destroyed along the representor netdev load/unload path without serialization by the devlink instance lock. When the reporter is destroyed concurrently with driver unbind, the devl_assert_locked() routine triggers an assertion failure, producing a kernel warning and potentially a crash, resulting in loss of kernel stability and a denial‑of‑service condition for local privileged users.

Both generic Linux kernel builds and those compiled with the mlx5e device driver are affected. The audit references commits applied around kernel 6.19, but the vulnerability existed prior to the patch that moves the reporter lifecycle to the eswitch devlink port. No specific version range is listed; any kernel prior to the inclusion of commit 7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937 is potentially vulnerable.

EPSS is not available and the issue is not in the CISA KEV catalog. The CVSS score is not disclosed. Based on the description, it is inferred that a privileged user who can load or unload the mlx5e driver and trigger the representor netdev removal sequence is required to exploit this race condition. The lack of proper locking creates a race condition that can force the kernel to assert and crash. While the attack surface is limited to environments running affected drivers, the impact of a kernel panic is high; thus the risk is considered significant for vulnerable systems.