A double free occurs in the RDMA/rxe driver when creating a shared receive queue. The code assigns a queue pointer before copying SRQ data into user space; if the copy fails, the pointer is freed while still stored in the structure. During cleanup a second free of the same memory is attempted, corrupting kernel memory. While the CVE description does not explicitly state that arbitrary code execution is possible, the nature of the bug – a double free in kernel space – introduces the potential for privilege escalation or system instability if an attacker can trigger the crash or abuse the corrupted memory region.

All Linux kernel builds that include the rdma_rxe driver are affected. No specific kernel version list is given in the advisory, so any release prior to the commit that introduced the fix is vulnerable.

The CVSS score is 7.8, indicating a moderate to high severity vulnerability. The EPSS score is less than 1%, suggesting a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires local or privileged user access to RDMA functionality, as the bug is triggered during RDMA SRQ creation. No public exploits are reported, but kernel memory corruption could be leveraged by an attacker with sufficient privileges or by a local process that uses RDMA verbs, making risk substantial for systems that expose RDMA to untrusted users or services.