The bug in the Linux kernel occurs when the function rds_conn_shutdown() consumes a concurrent drop event while performing a state transition. This race causes the shutdown path to inadvertently clear an unrelated drop flag, leaving a newly accepted socket attached to a down state that is never torn down. The result is a socket that remains established with callbacks armed, a path wedged in RDS_CONN_DOWN, and a growing receive queue, which can consume memory and prevent legitimate connections from being established. The weakness is a race condition (CWE‑366) that leads to resource exhaustion and denial of service.

The vulnerability affects the Linux kernel’s RDS transport in all versions prior to the patch that added the race‑condition guard. The affected vendor is Linux, and the product is the Linux kernel. Specific version ranges are not listed in the advisory; any kernel lacking the fix is considered vulnerable.

While the CVSS base score of 7.0 indicates moderate severity, the EPSS score of < 1 % shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw relies on a race between kernel operations, an attacker with network access to a machine running the RDS protocol can potentially trigger the race by sending crafted FIN or reset packets, leading to a denial‑of‑service condition where a socket remains established but unusable. The risk is moderate for systems that have RDS enabled, but the low EPSS suggests exploitation is unlikely without significant effort.