The rpcrdma subsystem in the Linux kernel contains a use‑after‑free bug caused by an imbalance in reference counting when an RDMA CM address change event occurs before a connection is fully established. The event handler mistakenly performs a reference count decrement without a corresponding increment, leading to underflow. When the connection tears down, the subsystem may operate on a freed endpoint object. This flaw can lead to a kernel crash and memory corruption.

All Linux kernel builds that include the RPCRDMA module and have not applied the patch are affected. This includes mainstream distributions and custom kernels that compile or load rpcrdma, regardless of vendor or configuration, until the code fix in the public commit is included. Users of older kernel releases lacking the commit should treat their systems as vulnerable.

The vulnerability carries a high CVSS score of 8.8 and an EPSS score of < 1%, indicating high severity but a relatively low current probability of exploitation. It is not listed in the CISA KEV catalog. A likely attack vector would involve an attacker able to influence RDMA CM events—such as by sending crafted address change messages—to trigger the use‑after‑free and cause kernel instability. While the conditions for exploitation are theoretically feasible, no publicly disclosed exploit is known.