The flaw lies in the concurrent removal and re‑initialization of the hns_roce v2 RDMA driver. During driver removal the bonding resources are released, but a reset later allocates them again, leaking the notifier callback. When the notifier chain is later invoked, the dangling reference triggers a kernel panic, halting the system.

All kernel builds that incorporate the unpatched hns_roce v2 driver. The vulnerability is present in Linux kernel releases before the bc4caea7a revert commit. Because the driver is part of the kernel, any distribution shipping such a kernel version is affected.

The CVSS score is 5.5, and the EPSS score is reported as less than 1%, indicating a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploitation has been reported. Based on the description, it is inferred that an attacker would need elevated privileges to unload and reload the RDMA driver, which is typically a privileged local operation. If such an action were achieved, a kernel panic could be forced, causing denial of service.