The Linux kernel’s Remote Distributed Shared Memory (RDS) over TCP implementation contains a use‑after‑free flaw. During a socket bind, rds_tcp_laddr_check() retrieves an IPv6 interface, releases the RCU read lock, and then calls ipv6_chk_addr(). While the lock is released, a concurrent link removal can free the net_device structure; ipv6_chk_addr() then dereferences the stale pointer, causing kernel memory corruption that could result in a crash or, based on the description, it is inferred that if the attacker can influence the freed memory, arbitrary code execution may be possible.

All Linux kernel releases that ship the rds module and perform IPv6 address verification during RDS socket bind operations are susceptible. The CPE indicates that the vulnerability spans the generic Linux kernel; no vendor‑specific or version details are supplied, so any system running an unpatched kernel with RDS enabled is at risk.

Exploitation requires the ability to trigger an RDS bind operation on an IPv6 socket on the affected system. This would necessitate some level of interaction with the local machine, though the exact access requirements are not specified. Because the defect is a kernel‑level use‑after‑free, successful exploitation could crash the system or, based on the description, it is inferred that it might allow escalation to kernel privileges if the attacker controls the freed memory. The EPSS score of < 1% suggests low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread use in the wild. Nevertheless, the CVSS score of 7.8 classifies it as high severity, and the potential for kernel compromise warrants immediate attention.