The kernel’s RDS/TCP connection logic creates an array of workqueues based on the caller’s transport. When the socket is redirected to the loopback transport, the number of paths is recomputed, causing a mismatch. The teardown uses the loopback transport’s size, freeing only the first path and leaving the remaining workqueues allocated. Repeating for each connection results in a leak of workqueue objects, which can exhaust resources and degrade kernel performance, potentially leading to denial of service.

This flaw affects Linux kernel implementations that include the RDS transport. All recent kernels that ship with the unchanged RDS/TCP path allocation code are vulnerable until the patch is applied.

The bug does not provide a direct remote code execution path, but it can be leveraged locally via a loopback connection to gradually consume kernel resources. The CVSS score of 3.3 and an EPSS score of < 1% indicate low severity and a very low probability of exploitation, respectively. However, the repeated allocation pattern suggests that sustained local use could trigger service disruption. The flaw is not listed in the CISA KEV catalog, implying no publicly known exploits at this time.