The bug is caused by publishing a notification object to the RPCRDMA xarray before its callback pointer is set. During a device removal that races with a new registration, the callback pointer may still be null and the kernel can then dereference it, leading to a kernel crash. The resulting denial of service can bring the entire system down or require a reboot.

Linux kernel implementations are affected, specifically any kernel that has the rpcrdma_rn_register and rpcrdma_rn_unregister paths built for RDMA protocol support. The exact affected releases are not enumerated in the available data, so all kernel versions prior to the applied patch for this issue are presumed vulnerable until a specific version list is released by the vendor.

The exploitability at the time of writing shows an EPSS score of less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet. However, the vulnerability requires local kernel access or the ability to trigger device removal or registration races, which are typical of privileged or local attackers. Because a null‑pointer dereference in the kernel can lead to an immediate crash, the severity is high from a confidentiality, integrity, and availability standpoint, even though the likelihood of exploitation remains low according to public metrics.