drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free).
3.13.0-164.2144.4.0-1032.354.15.0-1036.38~14.04.24.4.0-138.164~14.04.14.4.0-138.1644.4.0-1070.804.15.0-1036.38~16.04.14.15.0-1026.27~16.04.14.15.0-43.46~16.04.14.4.0-1036.42Exploitability
AV:LAC:LPR:LUI:NScope
S:UImpact
C:HI:HA:HCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H