Linux Kernel EUVD-2026-59368

Exploitation requires: (1) the target Linux system must be operating as an NFS client with the xprtrdma module loaded and an active or pending RPC-over-RDMA mount - systems using NFS over TCP are entirely unaffected; (2) the attacker must be adjacent on the same RDMA fabric (InfiniBand partition or RoCE Layer-2 segment) as the NFS client, since RDMA CM events are fabric-local; (3) the attacker must be able to trigger or coincide with an RDMA_CM_EVENT_ADDR_CHANGE event specifically during the pre-ESTABLISHED phase of the connection state machine - a race window typically spanning milliseconds. The race-condition requirement limits exploitation to scenarios where the attacker has reliable, low-latency fabric access and can synchronize with NFS reconnect cycles. Systems behind proper fabric partitioning or where xprtrdma is not in use are not exposed.

The provided CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates ease of exploitation. AC:L conflicts with the description: triggering ADDR_CHANGE before ESTABLISHED demands either manipulation of RDMA fabric routing state from the adjacent network or a coincidental infrastructure event, combined with a narrow millisecond-scale timing window - characteristics consistent with AC:H. The CIA impact trio of High is credible because kernel use-after-free can yield ring-0 code execution. EPSS at 0.21% (11th percentile) strongly supports low automated exploitation probability, and the absence of both a KEV listing and any public POC further reduces urgency. Real-world risk is therefore meaningful only for HPC clusters, storage-heavy enterprises, or financial infrastructure running NFS-over-RDMA on untrusted or shared RDMA fabrics. The CVSS AC:L vs. AC:H discrepancy should be verified with the kernel security team before using the provided score for prioritization decisions.

An attacker with a host on the same InfiniBand partition or RoCE segment as an NFS client running an unpatched kernel sends crafted RDMA fabric messages or manipulates routing state to cause an RDMA_CM_EVENT_ADDR_CHANGE event during the brief window after the client initiates a connection but before RDMA_CM_EVENT_ESTABLISHED is delivered. The resulting kref underflow causes rpcrdma_xprt_disconnect() to dereference a freed rpcrdma_ep object, enabling potential kernel memory corruption. No public proof-of-concept exists; reliably hitting the timing window adds substantial practical difficulty.