A flaw in the Linux kernel's rdma/rxe driver allows a remote initiator to send an ATOMIC_WRITE request with a zero‑byte logical payload. The responder dereferences 8 bytes at the end of the packet buffer regardless of the declared payload length, leaking 4 bytes of kernel tailroom per probe. An attacker can repeatedly send such probes to obtain recognizable kernel strings and partial kernel‑direct‑map pointer words, potentially aiding further exploitation or kernel exploitation tactics.

The vulnerability applies to all Linux kernel builds that employ the rdma/rxe driver before the fix was applied. No specific kernel releases are enumerated in the CVE data; the patch was introduced at commit 105bf79a23b85cf3a761d18a4f3e10ce88526bc1.

The attack vector requires network access to an RDMA interface that accepts ATOMIC_WRITE operations. While the CVSS, EPSS, and KEV metrics are unavailable, the incident demonstrates a remote disclosure potential; the exploitable environment is limited to RDMA traffic. Organizations that expose RDMA services to untrusted networks should treat this as a moderate to high risk pending patch deployment.