The vulnerability in the Linux kernel's RDS IB connection teardown occurs because the sends_out path frees the i_sends resource without clearing its pointer after a failure in rds_ib_setup_qp(). This stale pointer can then be misinterpreted as a valid allocation during repeated shutdown attempts, causing improper resource management. The fix involves clearing the i_sends pointer after freeing it to ensure the shutdown logic correctly recognizes resource ownership state.

The vulnerability has a critical impact with high confidentiality, integrity, and availability consequences as indicated by the CVSS vector. Improper handling of freed pointers can lead to use-after-free conditions, potentially causing kernel crashes, data corruption, or privilege escalation within the affected Linux kernel networking subsystem.

A fix has been implemented in the Linux kernel to clear the i_sends pointer after freeing it in the error unwind path. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the current remediation guidance.