The RDMA/siw subsystem in the Linux kernel contains a race condition that occurs when siw_qp_modify() fails during siw_accept(). The failure path clears an association reference (cep) only after the shared state lock is released, allowing a concurrent ibv_modify_qp() that transitions the same queue pair to ERROR state to free the cep while it is still referenced by the first thread. When the first thread later accesses qp->cep it dereferences freed memory, resulting in a use‑after‑free that can corrupt kernel data structures. The weakness is a classic example of improper cleanup under concurrency leading to memory corruption.

All variants of the Linux kernel that ship the RDMA/siw driver and have not incorporated the commits cited in the linked URLs are potentially vulnerable. No explicit version range or kernel release is specified, so any kernel lacking the post‑fix patches may admit an exploit, regardless of the kernel’s overall release date.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of < 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local or near‑local RDMA access to trigger the race, possibly by sending carefully timed RDMA commands to the target system. Successful exploitation would occur in kernel mode and could lead to privilege escalation or denial of service. The severity of a kernel memory corruption caused by this use‑after‑free is high, but the very small EPSS score and lack of public exploitation evidence reduce the immediate risk for typical deployments.