The bug in the Linux kernel occurs when the function rds_conn_shutdown() consumes a concurrent drop event while performing a state transition. This race causes the shutdown path to inadvertently clear an unrelated drop flag, leaving a newly accepted socket attached to the path in a down state that is never torn down. The result is a socket that remains established with callbacks armed, a path wedged in RDS_CONN_DOWN, and a growing receive queue, which can consume memory and prevent legitimate connections from being established. The weakness is a race condition (CWE‑362) that leads to resource exhaustion and denial of service.

The vulnerability affects the Linux kernel’s RDS transport in all versions prior to the patch that added the race‑condition guard. The affected vendor is Linux, and the product is the Linux kernel. Specific version ranges are not listed in the advisory; any kernel lacking the fix is considered vulnerable.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not disclosed, but the potential for resource exhaustion and the requirement of a race between kernel operations suggests a moderate to high risk when the RDS protocol is enabled. The likely attack vector is a network attacker sending specially crafted FIN or reset packets that trigger the race during RDS socket teardown operations, potentially leading to denial of service. External exploitation would require the attacker to have network access to the target machine and the ability to generate such packets.