A double free occurs in the RDMA/rxe driver when creating a shared receive queue. The code assigns a queue pointer before copying SRQ data into user space; if the copy fails, the pointer is freed while still stored in the structure. During cleanup a second free of the same memory is attempted, corrupting kernel memory. While the CVE description does not explicitly state that arbitrary code execution is possible, the nature of the bug – a double free in kernel space – suggests that privilege escalation or system instability could be possible if an attacker can trigger the crash or abuse the corrupted memory region. Based on the description, it is inferred that such outcomes are plausible but not yet confirmed.

All Linux kernel builds that include the rdma_rxe driver are affected. No specific kernel version list is given in the advisory, so any release prior to the commit that introduced the fix is vulnerable.

The CVSS score is 7.8, indicating a moderate to high severity vulnerability. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires local or privileged user access to RDMA functionality, as the bug is triggered during RDMA SRQ creation. Based on the description, it is inferred that no public exploits are currently known; however, kernel memory corruption could be leveraged by an attacker with sufficient privileges or by a local process that uses RDMA verbs, thereby increasing risk for systems that expose RDMA to untrusted users or services.