The flaw is a race condition in the Linux kernel networking driver net/mlx5e that leads to a use‑after‑free. When multiple threads tear down traffic‑control sample rules that share the same restore context, one thread may read the reference count after the restore lock is released while another thread has already freed the restore object. The remaining thread then dereferences a pointer that no longer references valid memory, which can corrupt kernel memory or trigger a kernel panic.

All Linux kernel builds that include the net/mlx5e driver are vulnerable. No specific version range is supplied, so any kernel prior to the applied patch may be affected. The driver is part of the upstream Linux kernel, thus any distribution that ships this driver could be impacted.

The CVSS score of 7.0 indicates high severity, while the EPSS score of < 1% reflects a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting no public exploits are known. The likely attack vector is local – an attacker who can trigger the teardown of traffic‑control sample rules (for example, via traffic‑control utilities) may induce the race. Successful exploitation could lead to kernel memory corruption and system crash, with a remote code execution possibility only if the freed data can be influenced.