During device initialization, the register_pkey_tree() function ignores errors from register_one_pkey_tree() and continues to register the remaining slaves. The per‑slave error path releases the parent kobjects for the pkey, but those freed pointers remain stored in the device data structure. When the device later performs cleanup, the stale pointers are passed to kobject_put(), causing a use‑after‑free. In kernel space this can lead to memory corruption, system crashes, or, if an attacker can trigger the flaw, privilege escalation.

The vulnerability affects all Linux kernel installations that include the IB/mlx4 driver and perform pkey sysfs registration. No specific kernel version was listed, so any system running an unpatched Linux kernel with this driver is potentially impacted.

The EPSS score is <1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is a kernel‑space use‑after‑free, a successful exploitation could lead to kernel memory corruption, system crash, or, potentially, privilege escalation if a local attacker can trigger the flaw. Based on the description, it is inferred that the attack vector would involve triggering a pkey sysfs registration failure during device cleanup, which is an internal kernel operation.