A race between retransmit_timer() and rxe_destroy_qp() in the RDMA rxe driver can reduce a Queue Pair's reference count to zero while a timer callback is still running, triggering a refcount underflow and a use-after-free. If an attacker can influence RDMA traffic, this flaw can cause a kernel panic or compromise kernel execution, potentially allowing local or remote attackers to crash or hijack the system.

All Linux kernels that contain the rxe driver before the patch, including current development releases. No specific version list is provided, so any kernel running rxe on a Linux system (e.g., Raspberry Pi 4 or other ARM devices) is potentially affected.

There is no EPSS score available and the vulnerability is not listed in CISA KEV. Because the flaw results in a use‑after‑free, the potential for exploitation is high if an attacker can generate RDMA traffic or otherwise trigger the race. Attackers with local privileges, or remote ones with RDMA access, could exploit the flaw to crash the system or dump memory.