The Linux kernel’s NVMe over RDMA subsystem performs resource cleanup on an EIO error. The original implementation reports a host path error and then continues to deallocate the command and unmap the SQE DMA, resulting in a second cleanup of an already completed request. This improper order can corrupt memory or trigger use‑after‑free behavior, corresponding to double free and improper use of freed memory.

All Linux kernel releases that include the NVMe over RDMA implementation are potentially affected; no specific version numbers are listed in the CVE data.

The CVSS score of 7 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of active exploitation in the wild. The vulnerability is not listed in CISA KEV. The double cleanup occurs in the error handling path of NVMe over RDMA when an EIO error is encountered; it is inferred that triggering this path would require a user capable of inducing such errors via NVMe command manipulation or abnormal device behavior, but the exact attack vector remains undocumented. Nevertheless, the risk of memory corruption remains significant enough to warrant remediation.