The CVE addresses a missing cleanup step for Frame Endpoint (FRMR) handles in the Linux kernel’s RDMA core. When the kernel fails to push an FRMR into its memory pool, the handle is not destroyed, leading to an unclaimed memory allocation. Over many failed push attempts, the kernel may accumulate unreleased resources, eventually exhausting available memory and reducing system performance, potentially culminating in a denial‑of‑service condition.

The vulnerability affects all Linux kernel builds that have RDMA support enabled and have not incorporated the commits 41a707d0275cdec9ac125e826dd6836fa9623cbc or a487c14dda02a649d84c8303772430d32bd76eb9. Any system running a kernel version prior to these changes is susceptible.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Although the advisory does not specify a concrete exploitation vector, repeated failures to allocate the memory pool could gradually deplete system memory if an attacker can trigger such failures or if they occur due to high load. Inferred that the risk remains moderate, dependent on the volume of FRMR push operations and the kernel's load conditions. The likely attack vector would involve inducing repeated allocation failures through sustained high‑load or malicious RDMA traffic.