A null pointer dereference occurs in the Linux kernel RDMA/ocrdma subsystem when the ocrdma_copy_pd_uresp() routine follows an error path before the uctx field of a protection domain has been initialized. The code dereferences a NULL pointer, causing a kernel panic that results in a system crash. This defect offers a denial of service vulnerability, as the attacker can trigger the crash but does not gain additional confidentiality or integrity privileges. The weakness is classified as a null pointer dereference (CWE-476).

All Linux kernel builds that include the ocrdma driver prior to the corrective commit are affected. The vulnerability exists in any kernel that compiles the ocrdma module without the patch that ensures a non‑NULL reference to pd->uctx. No specific version delimiters are listed beyond the generic Linux kernel, so every unpatched build that loads the ocrdma module is at risk.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the ability to influence RDMA traffic that reaches the ocrdma driver, typically involving local or privileged interactions with the RDMA device. Once such traffic induces the error path, the crash is deterministic, providing a straightforward denial of service.