In the Linux kernel, the IPoIB (Internet Protocol over InfiniBand) driver contains a race condition that occurs during a multicast flush operation. The flush temporarily clears the IPOIB_FLAG_OPER_UP flag to block multicast joins and restores it afterwards. If an interface is brought down while the flush is executing, the down routine clears the flag, but the flush may restore it again after the device has already been deactivated. This restores the flag out of sync with the device state, causing the workqueue that handles carrier transitions to retry indefinitely and deadlock the teardown process. The flaw is a race condition involving driver state flags and results in a permanent denial of Service for the IPoIB subsystem.

The vulnerability affects all Linux kernel distributions that include the legacy IPoIB implementation before the inclusion of commit 894021a75291, which introduced a dedicated IPOIB_FLAG_MCAST_FLUSH flag. Any kernel version that has not applied this commit is potentially vulnerable, regardless of the distribution or specific patch level.

The CVSS score is 7.0, indicating a medium‑to‑high severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local or privileged access that can bring an IPoIB interface down while a multicast flush is in progress. Based on the description, it is inferred that an attacker would need to trigger the race condition to cause a permanent denial of Service. Once the race is triggered, the system may deadlock until a kernel upgrade is performed.