The Linux kernel svcrdma module had a flaw where handle_connect_req() did not reject connection requests when svc_rdma_create_xprt() failed to allocate a transport. The connection manager (CM) core returned 0 for CONNECT_REQUEST events, preventing destruction of the new rdma_cm_id and causing a resource leak. Under memory pressure, this leak could be exploited by a remote peer to amplify resource consumption. The vulnerability was fixed by modifying the CM event handler to return a non-zero status on allocation failure, ensuring the CM core destroys the orphaned rdma_cm_id and prevents leaks.

The vulnerability causes a resource leak of rdma_cm_id objects in the Linux kernel under memory pressure conditions. A remote attacker can amplify this by repeatedly initiating connection attempts, potentially leading to denial of service due to resource exhaustion. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented that causes the connection manager event handler to reject connection requests when transport allocation fails, ensuring proper cleanup of resources. Users should apply the official Linux kernel update that includes this fix. Since no vendor advisory or patch link is provided, check the official Linux kernel repositories or vendor advisories for the patch and update accordingly.