An XDP redirect to an AF_XDP socket can fail when the receive ring is full, causing the core to free the associated buffer. When the driver subsequently refills a legacy cyclic request queue, it may free the same buffer again before assigning a replacement. If the refill only succeeds partially, a work queue entry remains with a stale buffer pointer that may already have been reallocated to another work item. A later refill retry can then free this live buffer through the stale reference, resulting in the same UMEM frame being published twice. The flaw is silent, produces no kernel warning or crash, and can manifest as data corruption or loss of packet integrity, as demonstrated in a high‑speed UDP test reaching millions of packets per second.

All Linux kernel environments that still contain the unpatched mlx5e driver code are susceptible. The flaw operates in the kernel’s network stack and affects any system utilizing XDP offload to AF_XDP sockets through Mellanox mlx5e network drivers. No specific kernel versions are listed, so all builds prior to the applied patch are potentially vulnerable.

The vulnerability has no publicly disclosed CVSS score, EPSS score, or KEV status, and no exploit has been reported in the wild. Nevertheless, the failure is silent and cannot be reliably detected by system administrators, which raises the risk. The attack vector is local to the kernel via packet processing, requiring sufficient traffic to trigger the race condition. Because the flaw could result in duplicate frame publication and data integrity problems, it is advisable to treat its potential impact as high while awaiting a definitive severity assessment.