During re‑registration of an InfiniBand memory region when the IB_MR_REREG_TRANS flag is set, the kernel releases a user memory region but fails to clear its reference pointer. When the user subsequently deregisters the region, the kernel attempts to release the same memory region a second time, causing a double free. This flaw is a classic instance of CWE‑1341: Critical Offset Vulnerability and CWE‑415: Double Free, and can lead to kernel heap corruption or a kernel crash, resulting in a denial of service on the affected host.

The issue resides in the Linux kernel’s irdma driver. Any kernel that bundles this driver before the inclusion of commit 5ac388db27c4 is potentially vulnerable. Since the kernel version is not specifically enumerated, all distributions shipping a kernel that lacks this commit are at risk.

The CVSS score is 7.8, which remains a medium severity vulnerability. The EPSS score is <1% and the issue is not listed in CISA KEV. Based on the description, it is inferred that the attack requires local RDMA operations and can be triggered by a user who can invoke the re‑registration path. While there is no documented exploitation beyond data corruption or a crash, the nature of the double free warrants timely correction.