The kernel’s RDMA driver contains an integer underflow in the rxe_rcv function. When calculating payload size, the code subtracts the packet header length, a BTH pad size, and an ICRC field from the reported packet length. Because the packet length check only verifies that the packet is at least the size of the header, an attacker can send a packet shorter than the header plus pad/ICRC, causing the payload_size calculation to underflow to a large value. This underflow allows the receive path to access memory outside allocated bounds, leading to memory corruption or execution of arbitrary code. The flaw is classified under CWE-191.

Any Linux kernel that includes the rxe RDMA module before the commit 2fd4f8b749309a61c3f3f88ee8891d94f79e1240. Systems that support RDMA over Converged Ethernet or InfiniBand with the rxe module loaded are vulnerable. No specific kernel version range was listed, so all older kernels lacking the fix are affected.

The flaw gives an attacker the ability to craft RDMA packets that are received by a target host. As this is a kernel memory bug, it can lead to privilege escalation or a kernel crash. The EPSS score is not available, and the CVSS score of 7.0 indicates high severity. The vulnerability is not listed in the CISA KEV catalog, yet the lack of external mitigation suggests a high risk if RDMA traffic is permitted. Administrators should treat this as a high‑risk remote code execution flaw, and immediate action is recommended.