An unpatched Linux kernel may leak kernel queues and their InfiniBand resources when the number of pending disconnecting queues exceeds the connect backlog limit. The leak occurs because the connect path drops the device reference but fails to deallocate the newly allocated queue, leaving residual kernel memory and IB resources unused. This uncontrolled resource consumption could ultimately exhaust available memory or IB resources, potentially causing the system to become unstable or unresponsive.

The vulnerability affects the Linux kernel's NVMe over RDMA implementation. Users running any Linux distribution with default nvmet‑rdma support in the kernel are potentially impacted, regardless of kernel version, until the patch is applied.

The public CVE has no EPSS score and is not in the CISA KEV list, suggesting limited observed exploitation. The CVSS score is unspecified. The issue can be exploited only by an attacker with kernel access or with the ability to initiate numerous RDMA connect requests to saturate the backlog. Based on the description, it is inferred that a local user with sufficient privileges can trigger the condition, while remote exploitation would require privileged RDMA access or a vulnerable client. Therefore, the risk is moderate, but the leak can cause denial of service if the backlog is repeatedly exceeded.