A reference count leak in the NVMe RDMA target occurs when a host queue backlog is exceeded during queue connection; the kernel obtains an ndev reference via kref_get() but fails to release it on the NVME_SC_CONNECT_CTRL_BUSY return path, causing the ndev reference to leak. The accumulated memory usage can grow until the system exhausts kernel memory, potentially leading to instability or a reboot. The underlying weakness is a resource leak (CWE-911).

The flaw resides in the NVMe RDMA target code of the Linux kernel. Any kernel release that contains the unpatched implementation, which includes default kernel packages shipped by mainstream distributions prior to the commit that fixes the leak (the referenced commit is 5828517d17), is potentially affected. No specific version numbers are supplied, so any kernel compiled before that commit is at risk.

Based on the description, it is inferred that an attacker would need the ability to initiate RDMA connections to the target and repeatedly trigger the backlog overflow condition. The likely attack vector is an RDMA host device that triggers queue connections exceeding the backlog. The CVSS score of 7.0 classifies this as a high‑severity denial‑of‑service vulnerability, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.