A race condition exists in the 9p RDMA subsystem of the Linux kernel because the rdma->state field is manipulated without holding the required req_lock spinlock in several code paths. The inconsistent locking can cause lost state transitions, corrupt the internal state machine, and ultimately lead to a use‑after‑free of RDMA request objects during teardown. The flaw is a classic example of a race condition that can evolve into a use‑after‑free vulnerability.

All Linux kernel installations that have not yet incorporated the patch adding req_lock protection to every modification of rdma->state in trans_rdma.c are affected. This includes all vendors’ kernel builds that were built before the patch, regardless of distribution, specific kernel version, or custom modifications.

The CVSS score of 9.8 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of public exploitation at this time. The description does not explicitly state an attack vector, so it is inferred that exploitation would require a local, timing‑dependent race during 9p RDMA operations, making successful exploitation technically difficult and likely limited to privileged or root users or environments with network access to a target 9p server. On successful exploitation, the kernel could crash or become unstable due to the use‑after‑free.