ib_device_get_netdev() returns a referenced net_device even when it is being unregistered. Later, ib_get_eth_speed() calls the device’s ethtool callback while holding the RTNL lock but fails to verify that the netdev remains registered. If an asynchronous RDMA port query runs after the netdev has been unregistered and its uninitialization has completed, the kernel may operate on freed memory, which can corrupt the kernel and cause a crash or other abnormal behavior. The vulnerability represents a classic kernel memory corruption scenario that occurs only when the attacker can trigger an RDMA port query while a network device is in the process of being unregistered, implying a locally privileged or compromised process is required.

The flaw exists in the Linux kernel’s RDMA subsystem; it applies to all Linux kernel versions that have not incorporated the patch described in the advisory. The CNA vendor list indicates Linux:Linux, meaning that affected systems are those running legacy or unpatched Linux kernels regardless of distribution.

The CVSS score of 7 indicates a high severity. The EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported yet. Nevertheless, because the flaw can lead to a use-After‑free that destabilizes the kernel, the risk remains moderate to high for organizations with local or privileged access to systems that use RDMA. The impact is the loss of integrity and availability through potential kernel crashes, and the attack vector is inferred to require the attacker to invoke an asynchronous RDMA port query during a netdev unregistration event.