The bug in the Linux kernel's RDS transport involves __rds_rdma_map() incorrectly handing ownership of sg/pages to the transport after a successful get_mr(). When copying the resulting cookie back to user space fails, the code previously freed those resources again, resulting in a duplicate unpin and free. This double‑free can corrupt kernel memory or cause a crash. The flaw is characterized as a resource mismanagement vulnerability (CWE‑763).

All Linux kernel builds with RDS support before the patch, including the 5.6 release‑candidate series (rc3–rc7). Systems running these kernels and with RDS enabled are vulnerable until the fix is applied.

With a CVSS score of 7.8 the vulnerability is medium to high severity. The EPSS score of less than 1% indicates a very low chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves triggering an RDS resource allocation followed by a failure to copy the cookie to user space, which may be induced by malformed or malicious RDS traffic from within network reach or by local exploitation when RDS is enabled. Until patched, the risk of kernel memory corruption or a denial‑of‑service attack exists.