The Linux kernel’s RDMA/Ionic subsystem contains a flaw in the function ionic_query_port, which calls ib_device_get_netdev() and then immediately dereferences the returned pointer without verifying that it is non‑null. If the lookup fails, the code dereferences a NULL pointer, causing a kernel panic and terminating the affected system. The immediate consequence is a denial of service for all users and processes relying on RDMA services, and the resulting kernel crash could potentially allow privilege escalation on platforms where a panic can be exploited. That escalation path is inferred from the nature of kernel panics rather than explicitly stated in the advisory.

All Linux kernel builds that include the RDMA/Ionic driver before the commit that adds the NULL check are affected. Systems running a kernel where the ionic_query_port function has not been patched and that use RDMA/Ionic networking are at risk.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.5, indicating a medium severity. The likely attack vector requires an attacker to invoke ionic_query_port with a non‑existent device name, which generally requires privileged access or the ability to manipulate RDMA configuration. Consequently, exploitation from an unprivileged remote attacker is unlikely, but local or compromised nodes that can influence RDMA services could trigger the fault and cause the system to panic.