The flaw involves a use‑after‑free in the Linux kernel’s mlx5 driver. When a table that has a miss table created through mlx5hws_table_set_default_miss is deleted, an entry remains in the miss_tbl list pointing to freed memory. If that list is later traversed, the dangling pointer can be dereferenced, causing undefined behavior such as memory corruption or a kernel panic.

The kernel executable with the buggy mlx5 module is affected. All Linux kernel builds that include the mlx5 driver code before the commits that fix the bug (identified by 16b81428, 60e9e82, 6efdc212) are vulnerable. No specific version numbers are listed, so any kernel compiled with the older code base must be considered at risk.

The CVSS score of 7 indicates a high impact, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation would likely require privileged access to the mlx5 driver’s table‑management interfaces or the ability to manipulate the driver’s internal state. An attacker who can trigger the fault may cause a kernel crash or, if the memory corruption can be controlled, potentially elevate privileges. No public exploitation evidence has been reported; the risk stems mainly from the structural weakness rather than widespread attack activity.