The flaw occurs in the svcrdma path when a failed accept triggers rpcrdma_rn_unregister without a prior register, resulting in an unmatched reference count decrement. The transport object (svcxprt_rdma) and associated resources remain allocated, creating a persistent memory and reference counter leak with each failed connection attempt. Over time, repeated failures could exhaust kernel memory or reference table entries, potentially causing a denial of service or instability.

All Linux kernel releases that include the svcrdma service prior to the patch that adds an rn_done guard are affected. The specific case involves the Linux kernel module handling Remote Direct Memory Access for RPC calls. Any distribution using a kernel image built before the commit that introduced the rn_done early‑return is vulnerable until the kernel is updated or rebuilt from a source tree containing the fix.

The CVSS score of 8.1 indicates a high severity flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so published exploit data is lacking. Attackers would need to induce repeated failed RDMA connection attempts, as the leak occurs during kernel‑space handling of these connects; this is inferred from the kernel context. Although not a remote code execution flaw, the kernel‑level resource exhaustion could be leveraged to disrupt service availability if a malicious actor can generate sufficient traffic to exhaust the leakable resources.