In the Linux kernel’s RDMA rxe module, a multicast group is prematurely inserted into an internal tree before the underlying Ethernet multicast address has been successfully programmed. When that programming fails—such as when the device is removed or the underlying dev_mc_add() fails—the newly allocated group is freed without being removed from the tree. A subsequent lookup of the same MGID dereferences the freed struct rxe_mcg, resulting in a memory corruption that can be leveraged for code execution by a local RDMA client.

The vulnerability exists in all Linux kernel releases that contain the rxe RDMA code prior to the patch commit. No explicit version list is provided, but the fix was merged into the kernel after the commits referenced in the advisory. Consequently, any distribution shipping an unpatched kernel is affected.

The flaw is local; it requires an RDMA client running on the same host to trigger the error path. The CVSS score is 7, the EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog. While exploitation is not trivial—requiring kernel memory corruption techniques—the potential impact is significant, allowing an attacker to execute arbitrary code at kernel privilege. Patch eliminates the race condition by ensuring the multicast group is only published after successful addition to the underlying network layer.