When XDP traffic is redirected to an AF_XDP socket, a full receive ring causes the kernel to free the buffer. The mlx5e driver, during a batching refill of a legacy cyclic request queue, may free that same buffer again before a replacement is assigned. If the refill is only partially successful, the work queue entry keeps a stale pointer to a buffer that might have already been reallocated to another work item. A later refill retry can free the live buffer through this stale reference, causing the same UMEM frame to be published twice. The flaw is silent, gives no kernel warning or crash, and can lead to data corruption or loss of packet integrity.

All Linux kernel environments running the Mellanox mlx5e network driver that contain the unpatched code are affected. Any system that offloads XDP to AF_XDP sockets via this driver is vulnerable, regardless of Linux distribution or kernel version built before the patch commit.

The CVSS score is 9.8 and the EPSS score is under 1 %, indicating that the vulnerability is severe but unlikely to be widely exploited yet. It is not listed in CISA’s KEV catalog. The flaw requires local packet processing; high traffic volumes speed the race condition, making the risk significant for high‑throughput network nodes. Because the failure is silent and not easily detected, the potential impact on confidentiality, integrity, or availability is high, even without an active exploit.