The Linux kernel’s RDS subsystem contains a flaw where, during an RDMA connection establishment, a peer negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION triggers the handler to call rds_conn_destroy() while holding c_cm_lock. This function synchronously tears down the connection and flushes a shutdown work queue that also requires c_cm_lock, creating a classic deadlock. The result is a permanent stall of the RDS workqueues, disabling all RDS traffic in the affected system.

All Linux kernel implementations are vulnerable, as indicated by the generic CPE entry for Linux kernels. Any distribution or custom build that includes the RDS module without the recent fix will be affected when RDMA traffic that negotiates a legacy protocol version is exchanged.

The flaw is not listed in the CISA KEV catalog and has an EPSS score of less than 1%, indicating a very low but non-zero likelihood of exploitation. The flaw has a CVSS score of 7.5, reflecting its high severity. Based on the description, the attack vector likely involves initiating or accepting an RDMA connection that negotiates a legacy protocol version; this inference is not directly stated in the CVE data. The vulnerability causes a deadlock in the RDS subsystem, leading to a permanent stall of the RDS workqueues and effectively denying services that rely on RDMA. The CVE description does not specify the privilege level required to trigger the vulnerability, so it is uncertain whether a privileged RDMA connection is necessary.