The Linux kernel RDMA counter subsystem contains a resource management flaw. When __rdma_counter_bind_qp() fails during the alloc_and_bind() routine, the error path frees the counter without decrementing port_counter->num_counters. The only place that decrements this counter is in rdma_counter_free(), a path that is unreachable in this failure case. Repeated failures cause num_counters to grow, preventing the RDMA port from switching to AUTO mode, blocking normal manual‑to‑none mode reverts, and ultimately locking the port into a permanent busy state. This results in a denial of RDMA traffic for the affected port until the counter state is reset, for example by rebooting the system or applying the patch that restores the counter decrement.

The flaw is present in the Linux kernel's RDMA implementation; any kernel that has the unpatched RDMA counter code is vulnerable. Systems that enable RDMA over InfiniBand, RoCE, or RDMA over TCP—often used in high‑performance compute, storage, or networking environments—are at risk if their RDMA stack is actively used. The specific kernel versions affected are not listed in the advisory, but the fix is contained in commits 4fbc823 and da95cb0, so kernels lacking those changes remain vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is lower than 1 %, implying a low probability of exploitation in the wild. The exact attack vector is not explicitly stated in the description; it is inferred that triggering repeated bind failures would likely require local access or the ability to influence RDMA configuration, but no remote exploitation vector is described. There are currently no known public exploits, and the vulnerability is not listed in the CISA KEV catalog. The weakness corresponds to CWE‑911 (Improper Resource Management), which governs the leak of a resource leading to service interruption.