The vulnerability occurs in the Linux kernel's svcrdma module when handling RDMA_CM_EVENT_ADDR_CHANGE events in svc_rdma_listen_handler(). If the creation of a replacement listener cm_id fails, the sc_cm_id pointer incorrectly continues to reference the old cm_id, which the Connection Manager core is about to destroy. Subsequent dereferences of sc_cm_id, such as in svc_rdma_detach() calling rdma_disconnect(), result in a use-after-free condition. The fix clears sc_cm_id on failure and adds a NULL check before calling rdma_disconnect(), allowing safe teardown of the listener during server shutdown.

This vulnerability can lead to use-after-free memory access in the svcrdma kernel module, potentially causing kernel crashes or undefined behavior during RDMA connection management. No known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to clear the sc_cm_id pointer on failure and guard against NULL dereferences. Users should update to a kernel version that includes this fix. No additional mitigation is required if the fix is applied.