The Linux kernel contains a flaw in the RDMA/umad subsystem within the ib_umad_write function. When an attacker supplies a user-controlled count that, combined with a mismatched MAD header size and RMPP header length, makes the calculated data_len negative, the kernel will call ib_create_send_mad. This function performs a memset using the negative value, causing an out‑of-bounds write that corrupts the kernel’s memory. The failure can trigger a KASAN error and may lead to a crash or give the attacker an opportunity to execute code with kernel privileges.

The vulnerability is present in all Linux kernel versions that use the RDMA/umad driver and have not incorporated the patch that rejects negative data_len. Because a particular range of kernel releases is not specified, any kernel build prior to the commit adding the explicit check is potentially vulnerable. Users of distributions that ship RDMA support – whether kernel 32‑bit or 64‑bit – fall into this category unless they have upgraded after the fix.

A severity score of 7.8 indicates a high risk if the flaw is successfully exploited. The likelihood of exploitation is considered low, with an estimated exploit probability below 1 %. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed exploits in the wild. Attackers would need local access to the affected system; the flaw is triggered by calls from userspace programs that interact with RDMA devices.