Linux Kernel EUVD-2026-28772

Requires target system equipped with Mellanox/NVIDIA ConnectX series network adapters using the mlx5_core driver (mlx5_ib, mlx5_vdpa variants also affected). Vulnerability triggers specifically during TX error CQE processing in the mlx5e_reset_txqsq_cc_pc() error recovery path - exploitation depends on ability to induce transmit errors in the hardware queue. This typically occurs under high network load, packet rate stress, or specific malformed traffic patterns that the NIC hardware rejects. Standard network access to send traffic to the vulnerable interface is required (CVSS AV:N), but actual exploitation is constrained by need to cause hardware-level TX failures rather than simple packet delivery. Kernel must be compiled with mlx5 driver support (CONFIG_MLX5_CORE=y/m) and driver actively loaded with interfaces configured. Systems without Mellanox hardware or with mlx5 driver disabled are not vulnerable. No special authentication or user interaction required once preconditions met.

Real-world risk is moderate despite the 8.2 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) suggests network-exploitable without authentication, but this assessment appears inconsistent with the technical details - the vulnerability requires triggering TX error CQEs in the mlx5 hardware, which is not directly controllable from remote network packets under normal conditions. The Low EPSS score (0.02%, 7th percentile) aligns with the narrow exploitability window: an attacker would need to cause hardware-level transmission errors in Mellanox NICs, which typically requires either physical access, misconfiguration, or cascading from another vulnerability. Not listed in CISA KEV, indicating no confirmed active exploitation. The 'High' availability impact (A:H) is justified - successful exploitation causes kernel warnings and could lead to memory corruption or system instability. The 'Low' integrity impact (I:L) reflects potential for limited data corruption through stale DMA operations. Primary concern is denial-of-service against systems using mlx5-based NICs (Mellanox ConnectX series) in high-throughput environments where TX errors might occur naturally or be induced. Patches available across all supported kernel branches reduce urgency for maintained systems.

An attacker on the same network segment as a vulnerable system with Mellanox ConnectX NICs identifies the target is running an unpatched kernel version. They generate malformed or oversized network traffic designed to trigger TX queue errors in the mlx5 driver, causing error CQEs. When the driver's recovery function mlx5e_reset_txqsq_cc_pc() executes with the desynchronized DMA FIFO counters, subsequent TX operations unmap stale DMA addresses, triggering IOMMU faults and kernel warnings. Repeated exploitation causes memory corruption and system instability, achieving denial-of-service. No public exploit code exists, and practical exploitation requires deep knowledge of mlx5 hardware behavior.