If two processes call the mlx5_eswitch_termtbl_put() function concurrently, the reference counter for a terminal table can be decremented to zero, its hash entry removed, and the structure freed while the other process still evaluates the counter. This race creates a use‑after‑free that corrupts kernel memory, potentially leading to a crash or arbitrary code execution with kernel privileges. The flaw stems from a missing synchronization boundary around the reference count check, a concurrency issue.

All Linux kernel releases that include the mlx5 driver without the commit that restores safe reference handling are affected. Because the data does not provide specific kernel versions, any system running an unpatched kernel with the mlx5 E‑Switch features is at risk. The vulnerability is part of the core kernel networking stack and applies to all distributions shipping the default kernel module.

The CVSS score of 7.0 signifies a high‑severity flaw. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker could trigger the race condition by manipulating traffic sent to the mlx5 interface, making the vulnerability potentially reachable from a local or remote network context. If successful, the attacker could corrupt system memory, crash the host, or gain kernel‑level privileges, but no public exploitation evidence is currently available.