The Linux kernel contains a reference leak in the mlx5 driver. When a reverse entry is located but its counter is already being released, the function refcount_inc_not_zero() fails and the reference that mlx5_tc_ct_entry_get() acquired is never released before the routine falls through to create_counter. As a result, the reverse entry remains alive indefinitely, effectively leaking a kernel resource and potentially leading to exhaustion or denial of service if the leak accumulates over time.

This issue is present in the Linux kernel’s network stack for all releases prior to the commit that introduced the fix. It affects systems that use the mlx5 driver on the Linux platform, including any distribution that ships with the unaffected kernel version.

The CVSS score is 2.5, indicating low severity, and the EPSS score is <1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no publicly recorded exploitation data exists. The likely attack vector is inferred to be through crafted network traffic that triggers the mlx5 counter lookup path, which an attacker could provoke by interacting with the mlx5 interface or by using privileged code to invoke the driver. The resulting reference leak could degrade system stability and lead to resource exhaustion, but given the low severity and low exploitation probability, the risk is considered moderate until the kernel is updated.