The Linux kernel RPCRDMA subsystem fails to balance a reference count when an RDMA CM address change event arrives before the connection is fully established. The event handler falls through to a disconnect path and decreases the endpoint’s reference count without a corresponding increment, causing the count to underflow. When the connection tears down, the code operates on a freed endpoint object, creating a use‑after‑free condition. This flaw can lead to a kernel crash and, in the right circumstances, enable an attacker to execute arbitrary code in kernel mode.

All Linux kernel builds that include the RPCRDMA module and have not applied the patch are affected. That includes mainstream distributions and custom kernels that compile or load rpcrdma, regardless of vendor or configuration, until the code fix in the public commit is included. Users of older kernel releases lacking the commit should treat their systems as vulnerable.

The vulnerability is a classic use‑after‑free in a privileged kernel subsystem (CWE‑416). While no EPSS score is currently available and the flaw is not listed in CISA’s KEV catalog, the severity of a kernel UAF warrants high‑risk treatment. An attacker who can manipulate or replay RDMA CM events (for instance by targeting a client or server that initiates RPCRDMA connections) could trigger the memory corruption, leading to a crash or privilege escalation. The absence of a known public exploit does not reduce the potential impact, because the conditions required for exploitation are realistic in environments that actively use RDMA connections.