During the setup of a Remote Direct Memory Access (RDMA) connection in the Linux kernel, the function for tearing down the RDS InfiniBand transport leaves a stale pointer to the i_sends send ring in memory when a setup failure occurs. Subsequent teardown logic may mistakenly treat this stale pointer as a valid allocation, causing a kernel use‑after‑free that can corrupt memory. This flaw is identified as CWE‑825.

Linux kernels that contain prior to the commit that clears i_sends during the error unwind path are affected. The vulnerability is present in any distribution kernel that exposes the RDS/IB transport layer without the fix, regardless of kernel version, because no specific version is listed.

The CVSS score of 7.0 indicates high severity. The EPSS score of less than 1% reflects a very low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires triggering a failed RDS InfiniBand connection setup followed by a teardown; the description does not specify whether remote or local access or privilege escalation is required, so the attack surface is uncertain. Consequently, the risk is moderate to high if an attacker can exercise the vulnerable path, but actual exploitation likelihood remains low based on available metrics.