The vulnerability results from incorrect handling of reference counts for RDMA request structures in the Linux kernel. A race condition allows a request to be freed while RDMA hardware is still accessing its buffers, which can corrupt kernel memory and trigger a crash. This represents a use‑after‑free flaw that can lead to loss of availability and potential compromise of kernel integrity. The weakness is typical of use‑after‑free bugs and unsafe concurrency rather than an attacker executing arbitrary code.

All Linux kernel installations that include the xprtrdma subsystem prior to the inclusion of the update described in the patch set. No specific version range is supplied, so any kernel version containing the described bug should be considered vulnerable until the fix is applied.

No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is not provided in the data, but the nature of the defect—a work‑unrelated memory corruption that can crash the kernel—indicates a high potential impact. Exploitation would require the ability to initiate RDMA requests against the affected system. Depending on the system configuration, this might be achievable from a local attacker or from a remote RDMA client if the RDMA network interface is publicly reachable. The attack vector is not explicitly stated, so it is inferred that the attacker needs either local privileged access or network connectivity to the RDMA endpoint.