The vulnerability resides in the kernel’s RDMA service handling. A race condition allows the transport’s notification entry to remain in the device’s resource map while the underlying RDMA identifier is destroyed, leading the kernel to dereference a freed object. This class of flaw can be used to execute arbitrary code with kernel privileges. The flaw is a classic use‑after‑free, classified as CWE‑416.

All Linux kernel installations are potentially vulnerable; the specific affected kernel versions are not listed in the available data. The vulnerability was addressed in commits linked in the advisory but no version range is provided in the input.

The exploit requires a concurrent timing attack between rdma_destroy_id and rpcrdma_rn_unregister. The must have the ability to interact with the RDMA service. The CVSS score of 4.1 indicates a low severity, yet the EPSS score is < 1%, indicating a very low probability of exploitation, and the flaw is not listed in CISA KEV. However, the severity inherent to a use‑after‑free in kernel space suggests a high risk to affected systems. The likely attack vector is local, potentially leveraging privileged processes or malicious RDMA configurations.