The Linux kernel fails to reset the op_nents counter when a zerocopy page pinning operation fails. This oversight causes the subsequent cleanup routine to iterate over an incorrect non‑zero count, freeing memory pages that were already released. The resulting double free can lead to kernel memory corruption, which in a privileged environment can be leveraged to run arbitrary code with kernel privileges. The vulnerability is therefore a severe kernel-level bug that, if exploited, could allow an attacker to execute code with elevated privileges.

All Linux kernel distributions are impacted, including the generic Linux kernel. No specific version range is listed, so any kernel build that compiled RDS without the patch may be vulnerable. Updating to a kernel release that incorporates the upstream patch (commit c/e1749297…) is required to remediate the issue.

The EPSS score is not available and the vulnerability is not catalogued in CISA KEV, indicating no publicly documented exploitation at this time. However, the flaw affects kernel memory management, a critical component that raises the impact of exploitation to high. The CVSS score is not specified, but the nature of the bug suggests a potentially high severity. Without evidence of active exploitation, the likelihood remains uncertain, but the risk of a privileged escalation scenario warrants immediate attention.