The flaw arises from incorrect handling of the RDMA/iwcm workqueue list in the Linux kernel. After a work entry is queued twice, the work handler walks a list that has already been partially reclaimed. This causes list pointers to be corrupted, triggering a kernel BUG and an oops that terminates the system. The impact is a kernel crash that results in a denial of service for the affected host.

The vulnerability exists in Linux kernel builds that implement the RDMA/iwcm interface before the associated fix commit. It affects all versions that include the buggy workqueue logic, for example kernels around 6.19 before the patch and earlier releases.

The CVSS score is not publicly available and EPSS is not listed; the vulnerability has not been reported in CISA KEV. The attack vector is inferred to require triggering RDMA workqueue activity, which typically requires kernel or privileged user context. An attacker who can send malformed RDMA traffic or control the workload may be able to induce the double‑queued work and force a list corruption, causing a local denial of service. The exploit does not provide persistence or privilege escalation beyond flooding the kernel with the faulty work. Overall risk is moderate, primarily due to the lack of public exploitation but high impact if triggered.