The vulnerability (CVE-2026-90423) involves the rxe_odp_mr_init_user() function in the Linux kernel's RDMA rxe driver. This function stores a pointer to umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, the function releases umem_odp and returns an error, but does not reset mr->umem to NULL. Later, during cleanup, ib_umem_release(mr->umem) is called, which assumes mr->umem is valid. Because mr->umem points to already freed memory, this leads to a use-after-free condition. The fix involves clearing mr->umem after releasing the failed ODP umem to prevent double release and UAF.

Successful exploitation could lead to memory corruption with potential consequences including privilege escalation, denial of service, or arbitrary code execution due to the use-after-free condition in kernel memory management. The CVSS score of 7.8 indicates high severity with high impact on confidentiality, integrity, and availability.

A fix has been implemented to clear the mr->umem pointer after releasing the failed ODP umem, preventing the use-after-free condition. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated here; check the official Linux kernel advisories or vendor distributions for the fixed kernel versions.