The RDMA rxe driver contains an integer underflow in the rxe_rcv function. During payload size calculation, the code subtracts the BTH pad and ICRC values from the packet length after only verifying the header size. An attacker can send a packet shorter than the required minimum, causing payload_size to underflow and produce a large value that is then used to access memory outside of valid bounds. The result is memory corruption that can lead to arbitrary code execution or a kernel crash. This flaw is identified as a CWE‑190 underflow condition.

Linux kernel distributions that include the rxe RDMA module before the commit that implements the fix (commit 2fd4f8b749309a61c3f3f88ee8891d94f79e1240). Any system that loads the rxe module for RDMA over Converged Ethernet or InfiniBand is vulnerable. Systems that have already applied the patch or do not use the rxe module are not affected.

The CVSS score of 9.1 indicates critical severity. The EPSS score is less than 1%, implying that the exploitation probability is currently very low, and it is not listed in CISA's KEV catalog. Nonetheless, the vulnerability can be triggered by an attacker who can forge RDMA packets and send them over the network to the vulnerable host; this is inferred from the description as the packet is received from the network. Remote attackers with RDMA connectivity can exploit the integer underflow to corrupt kernel memory, achieving privilege escalation or denial of service.