The RDMA/efa driver in the Linux kernel registers its interrupt request before it has fully created the administration completion queue and the asynchronous event queue, and it destroys these queues before it frees the IRQ. As a result, the IRQ handler can access dangling pointers that reference already freed memory, creating a use‑after‑free condition. This improper resource handling may corrupt kernel memory, causing a kernel panic or allowing an attacker to gain elevated privileges if the memory corruption is exploitable.

The vulnerability affects any Linux system that runs a kernel version before the patch that incorporates the RDMA/EFA driver fix, specifically systems that load the rdma_efa or efa modules and have RDMA/EFA enabled. All such kernels are considered vulnerable until the update is applied.

The CVSS score of 7.0 indicates a high severity, but the EPSS score of less than one percent suggests a low probability of current exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation would require a privileged or local user on a machine running the rdma_efa driver to trigger the IRQ handler after the queues are destroyed, leading to kernel memory corruption. This can result in a denial of service or, if the attacker can execute code with elevated privileges, privilege escalation.