The RDMA/rxe driver in the Linux kernel contains a flaw that allows an attacker to send a single UDP packet with an undefined opcode (such as 0xff) to a port used by the driver. The driver incorrectly validates packet length for unknown opcodes, leading to an integer underflow during checksum calculation. This underflow causes an out‑of‑bounds read of the packet payload, which in turn triggers a kernel panic. The result is a denial of service.

The vulnerability is present in any Linux kernel that includes the RDMA/rxe module. No specific kernel release is listed, but the issue is known to exist in the 7.0‑rc7 release when the module is loaded and a RDMA link is created. All systems running a kernel with the RDMA/rxe driver and without the recent packet validation fix are affected.

The CVSS score of 7.5 classifies this flaw as high severity. The driver’s lack of validation for unknown opcodes allows an unauthenticated attacker to send a single crafted UDP packet, which triggers an out‑of‑bounds read and a kernel panic. This denial of service can be achieved with only module load and a simple "rdma link add" command, requiring no authentication or additional configuration. The EPSS score of <1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not yet listed in CISA’s KEV catalog, but the potential for service disruption remains significant.