The Linux kernel’s RDS networking stack contains a flaw in the zerocopy send cleanup logic that can misclassify a message as owning normal payload pages when the message has not yet been queued. This incorrect cleanup can drop or reuse pinned pages in violation of their intended lifetimes, potentially corrupting kernel memory and triggering a kernel panic or other instability. The impact is a denial‑of‑service condition caused by a kernel crash rather than direct data exposure or remote code execution.

All Linux kernel releases that include the RDS protocol and have not yet incorporated the commit series fixing the zero‑copy send cleanup are affected. No explicit kernel version range is documented, so any installation of the RDS subsystem prior to the referenced patches should be considered vulnerable.

The advisory does not provide a CVSS or EPSS score, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a current high‑risk threat. The likely attack vector is local; an attacker who can generate RDS packets or otherwise initiate a zerocopy send to the host could trigger the inconsistent cleanup and induce a kernel crash. Because the flaw leads to kernel memory corruption without a demonstrated direct code execution path, exploitation requires a local presence and is therefore considered more complex than remote exploits.