A memory and resource leak vulnerability in the Linux kernel RDMA erdma driver could lead to system instability or potential exploitation by a local authenticated attacker.

The vulnerability exists in the erdma_destroy_qp, erdma_destroy_cq, erdma_dereg_mr, and erdma_destroy_ah functions. If a command timeout occurs during object teardown, the driver fails to release software owned resources, resulting in resource exhaustion which may be triggered by a local authenticated attacker.

Successful exploitation of this vulnerability could allow a local attacker to cause a denial of service by exhausting system resources. While the CVSS score of 7.0 reflects a high severity due to the potential for impacting system integrity and availability, the requirement for local access and specific hardware configurations limits the immediate attack surface. Organizations relying on RDMA-enabled Linux infrastructure should prioritize this update to maintain system stability.

Immediate Action: Update the Linux kernel to version 6.12.110, 6.18.52, 7.2.6, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel warnings related to RDMA command failures or unexpected resource allocation errors.

Compensating Controls: Restrict local access to systems utilizing the erdma driver to authorized personnel only, as the attack vector requires local access.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant stability risk for systems utilizing RDMA hardware. Because the flaw involves resource leaking, it may lead to performance degradation or system crashes over time. Administrators should incorporate the kernel updates into their regular patch management cycle to ensure the integrity and availability of their production Linux environments.