The vulnerability occurs in the Linux kernel’s svcrdma subsystem. When a transport is closed, threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait can become permanently stuck in a TASK_UNINTERRUPTIBLE state. During the close path the XPT_CLOSE flag is set but no explicit wake‑up is issued, so waiting threads never re‑evaluate their predicates. Consequently, these threads hold references to the transport, preventing svc_rdma_free() from completing and leading to a resource leak. The effect is a denial of service: affected kernel threads remain hung indefinitely, potentially exhausting system resources and preventing normal operation.

This issue affects the Linux kernel on all versions that include the svcrdma implementation. No specific vendor or product version is listed; the problem exists as long as the affected code path is present in the kernel.

The CVSS score is 7.5, but the EPSS score is indicated as less than 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog at present. Based on the description, the likely attack vector is remote, arising from a remote disconnect that triggers the problematic teardown path, though a local trigger could also trigger it by closing a connection from within the host. The exploit would involve causing a client to close the connection or disconnecting the RDMA transport, leading to kernel threads getting stuck and causing service disruption.