The Linux kernel’s RDMA core has a flaw in the aging of FRMR handles. When the aging process attempts to push a handle from the active queue to a non‑empty inactive queue, a page allocation may fail. The kernel code does not handle that fault, causing a leak of mkey references. The leak does not elevate privileges or disclose data but can exhaust kernel memory, eventually destabilizing the system. The issue is presented explicitly in the kernel description and is not an injected or remote code path.

All Linux kernels that do not contain the commit c6936506ed556ce3ccad36ab999baf2764dd7d25 (the patch that introduces push_queue_to_queue_locked). The commit is incorporated in kernel releases immediately following the commit date, so any kernel before that date is vulnerable. These kernels ship in all major Linux distributions that have not yet applied the patch.

EPSS <1% indicates a very low likelihood of exploitation in the wild. The CVSS score of 5.5 reflects a moderate impact. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need local or privileged RDMA access to trigger the aging process and provoke a memory leak, so the attack vector is likely local. Because the flaw only results in a memory leak, it cannot be used for remote code execution; however, sustained exploitation could lead to denial of service. The risk is thus moderate, and the best mitigation is to apply the patch.