The vulnerability is a kernel stack memory leak in the RDMA/irdma driver. During creation of a user address handle the driver’s response structure leaves four reserved bytes uninitialized. Only the handle ID is set, so the four bytes retain whatever stack data was present at the time. The description does not explicitly state whether these bytes are exposed to callers; based on the description, it is inferred that a malicious actor with RDMA access might read these bytes, but this is not guaranteed by the provided information. The leak could potentially expose sensitive kernel state, yet the representational impact depends on how the data is made observable to attackers.

All Linux kernel builds that incorporate the irdma RDMA driver are affected, as the issue resides in generic kernel source. Specific version ranges are not defined, so any kernel including the irdma module could be impacted until the fix is applied.

The CVSS v3 score of 5.5 indicates moderate severity, and the EPSS score of under 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require RDMA device support and the ability to create an address handle; however, the description does not clarify how a read of the leaked bytes is achieved. Consequently, while the potential for information disclosure exists, the actual exploitability remains uncertain.