This vulnerability is a use‑after‑free bug (CWE‑416) in the RDMA over Ethernet Fabrics (EFA) subsystem of the Linux kernel. When an admin command fails, the completion handler accesses and prints data from a completion context that has already been freed in the polling or interrupt, causing the kernel to read from an undefined memory region. The effect is to expose data that may have resided in the context to log output or error messages, potentially revealing sensitive information (CWE‑825). The flaw does not directly alter program state or crash the kernel; its impact is limited to confidentiality leakage via log leakage.

All Linux kernel builds that include the RDMA/EFA driver and do not contain the commit that fixes the bug are vulnerable. The issue affects kernels up through the 7.0 release candidates (rc1 through rc7) as well as older releases such as 5.12. Kernel versions in 7.0 RC8 and later, as well as stable releases after 7.0 incorporating the patch, are considered fixed.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low probability of exploitation. The bug appears to require local privileged execution to trigger the problematic error path in the RDMA/EFA module, making it unlikely to be leveraged remotely. Because the flaw only exposes data when the driver writes it to logs, an attacker would need to analyze those logs locally, further reducing the practical risk. The CVSS score of 7.8 reflects the high confidentiality impact, but overall risk remains moderate given the limited exploitation surface.