In the Linux kernel RDMA uverbs subsystem, the command ib_uverbs_post_send accepts a user‑supplied wqe_size and passes it directly to kmalloc before using the allocated memory as a struct ib_uverbs_send_wr. If the size is too small, later reads of fields such as opcode or num_sge go beyond the allocated region, causing an out‑of‑bounds read from kernel heap memory. This can leak arbitrary kernel data to userspace, revealing secrets such as passwords, cryptographic keys, or other sensitive information. The kernel also emits a warning when wqe_size is excessively large, a symptom of potential misuse identified by automated testing. The same validation that exists in ib_uverbs_unmarshall_recv() is missing here, leading to a serious information‑disclosure flaw.

Affects the Linux kernel, specifically the RDMA uverbs driver. No specific kernel versions are listed; the issue has been fixed in recent commits (e.g., 01c9b152). Any system that includes the affected code and interacts with RDMA devices may be vulnerable.

The flaw is local; an attacker must be able to run a userspace program that invokes the RDMA uverbs interface on the same host. Based on the description, the likely attack vector is through a local userspace program. Because the vulnerability leaks kernel‑heap data, its impact is significant, but no remote code execution or denial‑of‑service has been reported. The EPSS score is not available and the issue is not in the CISA KEV catalog, so the likelihood of exploitation is unknown, yet the potential for information disclosure makes it a high‑severity concern. Applying the kernel patch eliminates the root cause.