The vulnerability in the Linux kernel’s SRPT RDMA path allows an attacker to cause incorrect accounting of send queue credits when srpt_alloc_rw_ctxs() fails during a multi‑buffer indirect descriptor. During the unwind the kernel leaves stale counter values and a dangling pointer, so subsequent queue accounting may subtract an improper number of credits. This incorrect accounting can drain the available send credits, causing RDMA operations to stall or fail, effectively denying service for RDMA clients that rely on the affected subsystem.

The affected product is the Linux kernel with SRPT RDMA support. The CVE authors did not publish specific kernel version ranges, so every kernel that contains the srpt_alloc_rw_ctxs() routine and enables SRPT is potentially vulnerable. Administrators should identify kernels that include SRPT and are running a version that has not been updated to the commit that introduced the counter reset.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploits yet. The likely attack vector is through crafted RDMA traffic that forces srpt_alloc_rw_ctxs() to fail; this can be triggered by a local user on a compromised host or, if SRPT RDMA is exposed to an untrusted network, by a remote attacker capable of sending malicious RDMA packets. The flaw requires kernel privilege or escalated access to influence the RDMA subsystem, so the risk is local‑to‑kernel. An attacker could drain send‑queue credits, resulting in denial of service to RDMA clients or other applications that depend on the kernel’s RDMA stack.