The Linux kernel’s RDMA core module contains a reference counter that is initialized after the data structure is inserted into a global list. This race condition allows another CPU to increment the counter when its value is zero, producing an "addition on 0" bug that can corrupt kernel memory or cause a crash.

All Linux installations that use the affected kernel without the patch that moves the reference counter initialization before the list insertion. The exact kernel versions are not enumerated in the advisory, but any build prior to the commits referenced in the advisory is vulnerable. The flaw exists only when the RDMA subsystem is enabled.

The CVSS score of 7 and an EPSS score of less than 1% indicate a low probability of exploitation and moderate severity. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to generate RDMA traffic that triggers the race, suggesting a local or privileged attacker is required, though this inference is not explicitly stated in the CVE data.