In the Linux kernel a failure in allocating a new transport for an RDMA connection causes the connection request handler to return without freeing the allocated rdma_cm_id. This results in a resource leak: each failed allocation keeps one rdma_cm_id in memory, and impact is a gradual exhaustion of kernel resources, leading to a denial of service or system instability when memory pressure is present. The weakness is a classic memory leak (CWE-401) compounded by improper resource cleanup (CWE-772) and an improper return status (CWE-802).

The flaw exists in the Linux kernel’s svcrdma module, affecting any installation are enumerated, implying that versions prior to the applied to any host that runs RDMA.

The exploitability is reasonable for an RDMA‑enabled host: a remote client can repeatedly send connection requests to trigger allocation failures, leading to a cumulative leak of RDMA connection identifiers. The likely attack vector is a remote RDMA client initiating repeated connection attempts. EPSS indicates a sub‑1% chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating limitedSS score of 5.9 denotes moderate severity, but under sustained memory pressure the leak can exhaust kernel resources and result in a denial of service. Administrators should consider this a high risk for availability degradation, particularly in workloads that depend on consistent RDMA connectivity.