The Linux kernel’s RDMA/hns driver contains a flaw where the function hns_roce_qp_remove requires callers to hold specific locks, but the error unwind path in hns_roce_create_qp_common does not acquire those locks. This omission can corrupt kernel memory, potentially allowing a local attacker to execute arbitrary code with kernel privileges or destabilize the system.

The flaw affects all Linux kernel releases that contain the RDMA/hns driver, as no specific version range is listed. Users should verify whether the driver is active on their system and apply the latest kernel update that incorporates the referenced patch commits.

Based on the description, the vulnerability involves kernel memory corruption; a local attacker who can trigger the hns_roce_create_qp_common error path is inferred to be able to gain elevated privileges or crash the system. The EPSS score of < 1% indicates a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. While no remote exploit is documented, the local nature of the attack warrants prompt attention.