The flaw in the Linux kernel’s RDMA/mana subsystem originates from the unchecked length field rx_hash_key_len that originates from a userspace API structure. That length is passed directly into a memcpy call without bounds verification, allowing a userspace application to provide an oversized value and cause the kernel to copy data beyond the intended buffer. This memory corruption can enable arbitrary kernel memory writes, potentially allowing an attacker to execute code with kernel privileges or crash the system.

All Linux kernel builds that contain the RDMA/mana module without the validation patch are vulnerable. The affected builds include the default Linux kernel distribution and specific kernel versions listed in the CPE strings, such as 7.1 rc1 and rc2, as well as any other kernel before the patch that added the bounds check. No exact version numbers were provided, so any kernel prior to the fix that includes the rdma/mana subsystem is at risk.

Based on the description, it is inferred that the attacker must have local or privileged access to interact with the RDMA/mana interface. The vulnerability can be triggered by a userspace process that delivers a crafted length value, potentially leading to kernel memory corruption and privilege escalation or denial of service. The CVSS score of 7.8 indicates high severity, while an EPSS score of < 1% reflects low current exploitation probability. As the issue is not in the CISA KEV catalog, the exposure relies on the lack of original bounds checking in affected kernel builds.