The kernel RDMA/ocrdma subsystem contains a null pointer dereference on error paths within the ocrdma_copy_pd_uresp() routine. When the function encounters an error before pd->uctx has been initialized, the code dereferences a NULL pointer, causing an immediate kernel crash. This defect yields a denial of service as the kernel becomes unstable and must be restarted, but it does not directly grant any confidentiality or integrity breach. The weakness is a null pointer dereference (CWE‑824).

Any Linux kernel that includes the ocrdma driver before the commit that introduced a non‑NULL reference to pd->uctx is affected. The vulnerability is present in all kernels that compile with the ocrdma module until the patch is applied; no further version delimiters are provided in the vendor data.

The EPSS of <1% and the absence from the CISA KEV catalog suggest that exploitation is rare at this time. Based on the function’s role in processing RDMA PD responses, an attacker would likely need to trigger RDMA traffic that reaches the ocrdma driver and causes the error path. This typically requires the ability to send or influence RDMA frames to the device, which in many environments is limited to privileged or local users, but the exact prerequisites are not detailed in the published description. Once triggered, the crash is deterministic, providing a straightforward denial of service route.