The bug resides in the mlx5e driver of the Linux kernel, where XSK buffers are released only when an MPWQE is refilled. When an XSK allocation fails, the work‑queue head is not advanced and the same WQE is retried during a later NAPI poll. Because the slot was already marked for release, the driver calls xsk_buff_free again during the retry, freeing the same buffers a second time through stale pointers. This double‑free can corrupt kernel memory and, as is common with such errors, could be leveraged by an attacker to execute arbitrary code or cause a system crash.

All Linux kernel builds that ship the mlx5e (Mellanox Ethernet) driver and that use AF_XDP with a striding receive queue are potentially affected. The advisory does not specify an affected kernel version range, so any kernel containing the vulnerable code before the patch commit is at risk. Administrators should verify the version of the kernel and the presence of the mlx5e driver before applying mitigations.

The CVSS score of 9.8 classifies the flaw as critical. The EPSS score of <1% indicates that exploitation in the wild is presently unlikely. The flaw is not listed in CISA’s KEV catalog, suggesting no known active exploitation campaigns. The likely attack vector is a malicious or malformed AF_XDP packet that causes repeated XSK allocation failures and NAPI poll retries; however, based on the description this is inferred and not explicitly stated in the advisory. Given the severity and the nature of the double‑free, a successful exploitation could lead to denial of service, memory corruption, or remote code execution.