The vulnerability occurs in the Linux kernel RDMA/rxe subsystem when rxe_mmap removes a pending mmap descriptor while its reference count is still one, releasing a lock and subsequently walking page tables. A concurrent DESTROY_CQ ioctl frees the same descriptor’s memory before the page traversal completes, causing a null‑pointer dereference that leads to a kernel crash (general protection fault) or a page‑level use‑after‑free. The impact is a denial of service via kernel panic and, although unlikely, an exploitable use‑after‑free could allow an attacker to control kernel memory after a brief timing window.

All Linux kernel releases that include the rxe driver are affected until the upstream patch that removes the race condition is applied. No specific version numbers are provided, but the issue exists in all supported kernels up to the latest stable releases. The vendor is Linux: Linux.

The CVSS score is not supplied, but the nature of a kernel crash and potential UAF implies a high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed widespread exploitation at the time of reporting. The likely attack vector requires privileged access to an RDMA device, as the flaw is triggered through rxe_mmap and DESTROY_CQ ioctl calls; thus, it is a local privilege escalation scenario that demands a user with capability to open and manipulate RDMA devices. Due to the strict timing requirements and the need for coordinated device operations, the probability of successful exploitation is low.