A double free occurs in the RDMA/rxe driver when creating a shared receive queue. The code assigns a queue pointer before copying SRQ data into user space; if the copy fails, the pointer is freed while still stored in the structure. During cleanup a second free of the same memory is attempted, corrupting kernel memory. While the CVE description does not explicitly state that arbitrary code execution is possible, the nature of the bug – a double free in kernel space – introduces the potential for privilege escalation or system instability if an attacker can trigger the crash or abuse the corrupted memory region.

All Linux kernel builds that include the rdma_rxe driver are affected. No specific kernel version list is given in the advisory, so any release prior to the commit that introduced the fix is vulnerable.

The advisory does not provide a CVSS score or EPSS score, and the vulnerability is not listed in the CISA KEV catalog. The attack vector likely requires local or privileged user access to RDMA functionality, as the bug is triggered during RDMA SRQ creation. No public exploits are reported, but the kernel memory corruption could be leveraged by an attacker with sufficient privileges or by a local process that uses RDMA verbs. Risk is therefore significant for systems that expose RDMA to untrusted users or services, and is mitigated by applying the patch.