The vulnerability in the Linux kernel's smbdirect subsystem was due to an incorrect resource teardown sequence on the rdma_accept_failed error path in smbdirect_accept_connect_request(). Specifically, the receive I/O object (recv_io) was still outstanding on the QP when the memory pools and slab cache were destroyed, causing use-after-free conditions and a NULL-pointer dereference during mempool_free_bulk. The fix introduced a dedicated teardown path that drains the QP before destroying memory pools, preventing the slab cache from having outstanding objects at shutdown.

This vulnerability can cause a kernel NULL-pointer dereference leading to a denial of service (system crash or instability). There is no indication of confidentiality or integrity impact. The CVSS score of 7.5 reflects a high severity denial of service vulnerability exploitable remotely without privileges or user interaction.

A fix has been implemented in the Linux kernel to correct the teardown order in the smbdirect component. Users should apply the official kernel update that includes this patch to remediate the vulnerability. No additional mitigations are indicated by the vendor advisory.