The vulnerability occurs in the Linux kernel RDMA/rxe subsystem when rxe_mmap removes a pending mmap descriptor while its reference count is still one, releasing a lock and subsequently walking page tables. A concurrent DESTROY_CQ ioctl frees the same descriptor’s memory before the page traversal completes, causing a null‑pointer dereference that leads to a kernel crash (general protection fault) or a page‑level use‑after‑free. Based on the description, it is inferred that an attacker would need privileged RDMA access to trigger the race condition, and the impact is a denial of service via kernel panic and, although unlikely, an exploitable use‑after‑free could allow an attacker to control kernel memory after a brief timing window.

All Linux kernel releases that include the rxe driver are affected until the upstream patch that removes the race condition is applied. No specific version numbers are provided; based on the absence of detailed version information, it is inferred that any kernel version containing the rxe driver prior to the patch is affected. The vendor is Linux: Linux.

The CVSS score is 7.8, indicating a high severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed widespread exploitation at the time of reporting. Based on the description, it is inferred that the likely attack vector requires privileged access to an RDMA device, as the flaw is triggered through rxe_mmap and DESTROY_CQ ioctl calls; thus, it is a local privilege escalation scenario that demands a user with capability to open and manipulate RDMA devices. The strict timing requirements and the need for coordinated device operations make successful exploitation unlikely.