The Linux kernel’s SRPT RDMA subsystem contains a flaw in the srpt_alloc_rw_ctxs routine. When allocation of read/write contexts fails during a multi‑buffer indirect descriptor, the unwind path removes the RDMA contexts but does not reset internal counters (n_rw_ctx and n_rdma) and leaves a dangling pointer. Subsequent accounting operations may subtract an incorrect number of send‑queue credits, which can deplete available credits and cause RDMA send operations to stall or fail. This issue results from improper resource cleanup and improper initialization of pointers.

All Linux kernel releases that include SRPT RDMA support—specifically kernels containing the srpt_alloc_rw_ctxs routine with SRPT enabled—are potentially affected. The exact kernel version range is not specified, so any kernel that contains the srpt_alloc_rw_ctxs routine and has SRPT enabled is potentially vulnerable. Administrators should review the kernel versions in use and determine whether SRPT is active.

The CVSS score of 9.8 classifies the issue as critical. The EPSS score is less than 1%, indicating that the probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits exist as of this analysis. The likely attack vector involves sending crafted RDMA traffic that forces srpt_alloc_rw_ctxs to fail; based on the description, it is inferred that this could be initiated by a local user on a compromised host or, if SRPT RDMA is exposed to an untrusted network, by a remote attacker with access to the RDMA interface. The flaw requires kernel privilege or escalation to influence the RDMA subsystem; the primary risk is a local‑to‑kernel denial‑of‑service to RDMA clients that depend on proper credit accounting.