Kernel memory corruption via unset RDMA queue pointers

Use-after-free in Linux kernel 5.15 allows local users to corrupt kernel memory by triggering an mlx5 queue-pair creation failure. RDMA core passes the new queue-pair object to the driver before setting its send and receive completion-queue pointers, so failure cleanup later writes through the freed object. Exploitation requires local access to the RDMA userspace verbs interface on an mlx5-capable system; the demonstrated result is a KASAN-detected write after free.