The defect revolves around cleanup logic in the RDMA/mana subsystem when creating a Queue Pair RSS. A duplicate decrement of an index counter causes the shutdown loop to skip an entry, while a failure in installing a completion queue callback prevents earlier work‑queue objects from being undone. This results in dangling references that may later be dereferenced or freed twice, corrupting kernel memory. Consequently, the system can crash or become unstable, yielding a denial‑of‑service.

The generic Linux kernel is affected when the RDMA/mana driver contains the buggy code path. Specific version information is not listed in the advisory; however, any kernel build before the patch commit that introduces the double decrement fix is potentially vulnerable. Systems that load the mana module or use RDMA operations are the most likely to exercise the vulnerable code.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The documented effect of a kernel crash indicates high risk. Exploitation would require the attacker to trigger the error path—most likely by running a local RDMA application that stimulates a QP RSS creation failure. With sufficient privilege or local access, this can be used to bring the system down, forcing a reboot or shutdown. The attack vector is likely local or within a privileged user space RDMA workload rather than remote.