The rds transport in the Linux kernel incorrectly performs a duplicate unpin and free when an MR allocation succeeds but a subsequent copy of the cookie to user space fails. This double‑free path can corrupt kernel memory or cause a crash, as the transport tries to release resources it no longer owns. The flaw falls under CWE‑763, highlighting resource mismanagement.

All Linux kernel builds that include RDS support and are affected by the bug, prior to the commit that removes the duplicate unpin/free. No specific kernel version list is provided, so any kernel with RDS enabled before the patch is vulnerable.

The CVSS score of 7.0 signals a medium‑to‑high severity. Based on the description, the likely attack vector is causing an RDS MR allocation followed by a failure to copy the generated cookie to user space, which could be triggered by malicious RDS traffic from an attacker within network reach or by privileged kernel code. The EPSS score is not available, which indicates that the exploitation probability is not known. The vulnerability is not listed in the CISA KEV catalogue, implying a lower likelihood of widespread exploitation. Nonetheless, the risk of kernel memory corruption or denial‑of‑service warrants immediate remediation.