The flaw lies in the xprtrdma receive handling code. A malformed or unrecognized RPC/RDMA reply can be sent to a Linux kernel client, causing the recipient to decrement its receive buffer count without reposting a new buffer. Repeatedly sending such replies drains the client’s receive queue, eventually leaving the transport stalled until a reconnect occurs, resulting in abrupt service interruption for applications relying on RPC/RDMA communication.

All Linux kernel builds that include the xprtrdma module are affected, covering commonly deployed distributions such as Ubuntu, Debian, RedHat Enterprise Linux, CentOS, Fedora, and others. Any system running a kernel version before the change that introduced the repost logic is impacted. The CVE data does not specify exact kernel versions, so administrators should verify whether their running kernel predates the relevant commit.

A remote attacker can trigger the vulnerability over an open or authenticated RPC/RDMA channel by flooding the target with short replies. The attack requires only network connectivity to the vulnerable service and does not rely on privileged local access. The CVSS score of 7.5 indicates a medium-to-high severity for the denial‑of‑service effect. Although the EPSS score is <1% and the issue is not listed in CISA KEV, this denial‑of‑service effect is severe because it permanently stalls the transport until the connection is reestablished and can be triggered without user interaction or additional exploit code.