A race between retransmit_timer() and rxe_destroy_qp() in the RDMA rxe driver can cause the reference count of a Queue Pair to drop to zero while a timer callback is still executing, triggering a refcount underflow. The kernel developers describe the resulting warning as harmless because the cleanup path flushes pending timers and requests before the queue pair is fully torn down. Still, the trigger for a use‑after‑free indicates a potential for kernel corruption or panic if the race can be timed precisely. The vulnerability is scored at CVSS 7.8, reflecting a high severity based on the theoretical impact of a kernel‑level use‑after‑free.

All Linux kernels that include the rxe driver are potentially affected. No explicit version list is provided, so any installation of the Linux kernel that loads the rxe module—such as development releases or ARM‑based devices like the Raspberry Pi 4—may be impacted.

The EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The flaw is not listed in CISA KEV. Attackers who can influence RDMA traffic or otherwise trigger the race may be able to cause a kernel crash or memory corruption; however, the kernel’s cleanup logic reduces the practical risk. The likely attack vector is through RDMA traffic, but this is inferred from the description because the vector is not explicitly stated.