The Linux kernel's RDMA rxe_mmap function improperly handles reference counting and locking around the rxe_mmap_info struct. Specifically, rxe_mmap removes the struct from the pending_mmaps list and releases the pending_lock while the struct's reference count remains at 1. Concurrent DESTROY_CQ ioctl calls can then free the struct and its associated vmalloc memory while remap_vmalloc_range_partial is walking page table entries without holding a lock. This race condition can cause kernel crashes due to null pointer dereferences or use-after-free of pages, potentially allowing attackers to gain a page-level use-after-free primitive. However, the timing window for exploitation is very narrow, making practical exploitation difficult. The vulnerability was fixed in the Linux kernel.

This vulnerability can cause kernel crashes (general protection faults) and page-level use-after-free conditions in the RDMA rxe_mmap subsystem. The use-after-free could allow an attacker to access freed memory pages, which might be reallocated later, potentially leading to memory corruption or privilege escalation. However, exploitation is statistically difficult due to the short timing window. No known exploits are reported in the wild.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a kernel version that includes the fix is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or distribution security updates for the exact fixed versions and apply them accordingly.