The flaw in the Linux kernel arises in the RDMA/iwcm module when the workqueue list is incorrectly managed, a list corruption weakness classified as CWE-1341. After a work item is queued twice, the handler walks a list that has already been partially reclaimed, corrupting its pointers. This results in a kernel BUG and an oops that terminates the kernel, causing a system crash and a denial of service for the affected host.

The vulnerability exists in Linux kernel releases that implement RDMA/iwcm before the fix commit e1168f0, which removes the custom work_list. Linux kernel versions up to 6.19‑rc4 and earlier builds are impacted. Vendor is Linux: Linux; product is the Linux kernel.

The CVSS score is 9.8, and the EPSS score is less than 1% (0.00018). The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves triggering RDMA workqueue activity, either via local privileged users or potentially remote RDMA traffic. An attacker who can send crafted RDMA packets or otherwise stimulate the workqueue may induce the double‑queued work that leads to list corruption, culminating in a kernel crash. The high impact is tempered by the very low probability of exploitation reported so far.