The Linux kernel RDMA/ucma subsystem contains a race condition that allows an attacker to trigger a use-after-free on a ucma_multicast object. When two JOIN_MCAST operations target the same address concurrently, a copy_to_user failure can cause the second thread to free the object before the first thread’s leave removes it. The remaining worker thread then dereferences freed memory, leading to kernel memory corruption. This flaw can cause a kernel panic or be exploited to gain elevated privileges if an attacker can supply arbitrary RDMA traffic to the target system.

All Linux kernel installations that load the RDMA/ucma module and have not applied the latest patch are affected. The vulnerability is present in the generic kernel source, so any kernel version that includes the unpatched RDMA/ucma code is potentially vulnerable; no specific version range is indicated. This applies to distributions that ship the unmodified kernel or that build their kernel from the upstream source with the legacy RDMA module enabled.

The flaw is a classic use-after-free combined with a race condition, providing a high severity kernel memory corruption. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, which suggests that no public exploits are known yet. However, because a local attacker who can issue RDMA commands can trigger the race, the potential for privilege escalation exists. The likely attack vector is local through RDMA traffic; a remote attacker would need to influence RDMA communication to the victim host.