The vulnerability originates in the RDMA mana subsystem of the Linux kernel, specifically within the mana_ib_create_qp_rss() function. User input that specifies work queues sharing the same completion queue triggers a WARN_ON() guard, which can lead to kernel memory corruption. If the guard is hit, the function continues execution and corrupts internal kernel data structures, which may allow an attacker to crash the system or potentially execute arbitrary code with kernel privileges. The flaw is a memory corruption issue as it fails to validate user‑provided parameters before use.

This flaw affects all Linux kernel builds that contain the unpatched mana RDMA driver. No specific version range is listed in the notification, so any kernel variant shipping with the vulnerable code is potentially impacted until the fix is applied. The issue is tied to the Linux kernel product group.

Because the flaw involves kernel memory corruption, its severity is high. The CVSS score is not publicly published, but the lack of an EPSS score and absence from the CISA KEV list do not diminish the intrinsic risk of a kernel crash or privilege escalation. The likely attack vector is local or remote access to the RDMA user‑level API; an attacker who can provide crafted WQ identifiers to a running system can trigger the guard. With trivial prerequisites (RDMA client code), kernel corruption can be achieved. Until a kernel upgrade is available, unmitigated systems remain at risk.