The Linux kernel RDMA/rxe component improperly reprocesses the current packet after the QP enters the error state. When do_complete() detects the error state, it returns RESPST_CHK_RESOURCE, but due to a prior commit removing the error-state branch from check_resource(), the responder state machine loops back and re-executes the same packet multiple times. This causes duplicate IB_WC_SUCCESS completions indistinguishable from legitimate receives, corrupting the data stream for protocols relying on exactly-once delivery. Eventually, a NULL pointer dereference occurs when the receive queue is exhausted. The fix involves returning RESPST_CLEANUP for live packets in the error state to consume but not reprocess them.

This vulnerability can cause data stream corruption for upper-layer protocols that depend on exactly-once delivery semantics due to duplicate packet completions. It also leads to a kernel NULL pointer dereference and crash, impacting system stability and availability. There is no indication of confidentiality or integrity loss beyond the described data duplication and crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, be aware that RDMA/rxe may deliver duplicate completions and potentially cause kernel crashes under error-state conditions. Monitor for kernel updates addressing this issue.