During the teardown of an AF_XDP transmit queue in the Linux mlx5e driver, a requested transmit timestamp that has no corresponding completion queue entry is passed to a function that dereferences a null pointer. The dereference causes a kernel panic, leading to a system crash. The weakness is a null pointer dereference classified as CWE-476.

All kernel builds that include the mlx5e driver and have not yet incorporated the commit that returns zero when no CQE is available are affected. This covers any distribution that ships the upstream Linux kernel before the fix, including common enterprise releases and custom builds that use the standard Mellanox mlx5 driver.

The flaw has a CVSS score of 4.4, indicating moderate severity. The EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability does not appear in the CISA KEV catalog. Based on the description, the likely attack vector is local or requires a level of privilege that allows the creation of AF_XDP sockets; however, the exact privilege requirement is not explicitly stated and is inferred from the need to interact with the driver in kernel mode.