The vulnerability in the Linux kernel RDMA core involved a use-after-free condition in the ib_free_cq() function. The synchronization mechanism for accessing a CQ via the netlink path relied on rdma_restrack_get(), but rdma_restrack_del() was called too late—after vendor-specific resources were freed. This timing allowed a short window where the CQ was still accessible through restrack, creating a potential use-after-free scenario. The fix moved the rdma_restrack_del() call to before freeing vendor-specific resources, ensuring the CQ is removed from restrack before its internal resources are released, preventing new references to a CQ being destroyed.

The vulnerability could allow local attackers with limited privileges to exploit a use-after-free condition, potentially leading to high impact including confidentiality, integrity, and availability compromises of the affected system. The CVSS score of 7.8 reflects a high severity with local attack vector, low attack complexity, and no user interaction required.

A fix is available that changes the order of resource cleanup in the ib_free_cq() function to prevent the use-after-free condition. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation.