The Linux kernel svcrdma transport had a flaw where threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait could remain indefinitely in TASK_UNINTERRUPTIBLE state when the transport closed. This happened because the wait predicates were only re-evaluated on wakeup, and sc_sq_ticket_wait lacked an explicit wake path on close. As a result, threads held references preventing svc_rdma_free() from completing. The fix introduced svc_rdma_xprt_deferred_close(), which wraps svc_xprt_deferred_close() and explicitly wakes both waitqueues. This wrapper was used in all relevant close paths to ensure parked threads re-evaluate their wait conditions and exit properly, allowing resource cleanup to proceed.

Affected threads can hang indefinitely in an uninterruptible state during transport teardown, causing resource references to remain held and blocking cleanup functions like svc_rdma_free(). This can lead to resource leaks and potential denial of service conditions on the affected transport. There is no indication of remote code execution or privilege escalation from this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves kernel code changes introducing svc_rdma_xprt_deferred_close() and modifying transport close paths to wake waiting threads. Users should monitor official Linux kernel advisories and update to fixed kernel versions once available.