In the Linux kernel’s RDMA/irdma subsystem a deadlock can occur when the network device driver is reset while active iWARP connections exist. The reset removes the irdma auxiliary driver, leading to device deletion and client removal. During this process, the uverbs_client waits for the QP reference count to fall to zero while the cma_client holds the final reference, creating a circular dependency that blocks the system indefinitely. The result is an unintended hang of RDMA services and a denial of network connectivity for applications that rely on iWARP. The weakness is represented by CWE‑667 (deadlock).

The vulnerability affects all versions of the Linux kernel that include the irdma driver, specifically the stable 6.4 line and all 7.0 release candidates from rc1 through rc7. The corresponding CPE identifiers indicate that any Linux operating system running these kernel versions is susceptible unless the irdma driver is disabled or the kernel has been patched to remove the circular dependency.

The CVSS score of 5.5 denotes moderate impact, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. Because inducing the deadlock requires a netdev reset during active RDMA traffic—a capability typically restricted to privileged users—the primary exploitation surface is local system compromise or misconfiguration. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit has been reported. Nonetheless the symptom—a hung RDMA subsystem—can disrupt critical workloads dependent on high‑performance network interfacing, so immediate mitigation is advised.