A flaw in the Linux kernel's rdma/rxe driver allows a remote initiator to send an ATOMIC_WRITE request with a zero‑byte logical payload. The responder dereferences 8 bytes at the end of the packet buffer regardless of the declared payload length, leaking 4 bytes of kernel tailroom per probe. An attacker can repeatedly send such probes to obtain recognizable kernel strings and partial kernel‑direct‑map pointer words, potentially aiding further exploitation or kernel exploitation tactics.

The vulnerability applies to all Linux kernel builds that employ the rdma/rxe driver before the fix was applied. No specific kernel releases are enumerated in the CVE data; the patch was introduced at commit 105bf79a23b85cf3a761d18a4f3e10ce88526bc1.

The CVSS score is 7.5, EPSS is <1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires network access to an RDMA interface that accepts ATOMIC_WRITE operations. This limits the exploitable environment to RDMA traffic. The incident demonstrates a remote disclosure potential, with attackers able to leak kernel memory into their MR. Organizations that expose RDMA services to untrusted networks should treat this as a moderate to high risk pending patch deployment.