The Linux kernel's irdma RDMA driver used a waitqueue and a request_done flag without proper memory barriers. This missing ordering allowed a race condition where the flag could be observed before the underlying state update, potentially causing the driver to misunderstand the completion status of requests. As a result, the RDMA subsystem could report false completions or stall, creating an inconsistent kernel state. The flaw is a concurrency weakness that could be leveraged to cause denial of service or, under specific circumstances, to corrupt shared memory.

The flaw exists in all kernel releases that contain the earlier irdma implementation, before the corrective commit bde37aed. The affected product is the Linux kernel from all vendors using the standard distribution. Any system running a kernel that has not incorporated the completion-based fix remains vulnerable.

The vulnerability does not have an associated EPSS score and is not listed in CISA's KEV catalog, indicating it has not yet been observed in the wild. The attack vector is local and requires the ability to send RDMA packets to the vulnerable driver. While the patch replaces the waitqueue+flag with a completion primitive, the corrected code mitigates the race condition, lowering the exploitation probability. Nonetheless, administrators should treat the issue as a moderate risk until the kernel is updated.