The flaw in the Linux kernel’s RDMA/mana subsystem originates from the unchecked length field rx_hash_key_len that originates from a userspace API structure. That length is passed directly into a memcpy call without bounds verification, allowing a userspace application to provide an oversized value and cause the kernel to copy data beyond the intended buffer. This memory corruption can enable arbitrary kernel memory writes, potentially allowing an attacker to execute code with kernel privileges or crash the system.

All Linux kernel builds that contain the RDMA/mana module without the validation patch are vulnerable. No specific version numbers are listed, so any kernel before the patch that added the bounds check is at risk.

The vulnerability can be triggered by a local or privileged userspace process that interacts with the RDMA/mana interface, making it feasible for an attacker to deliver a crafted length value. Successful exploitation would likely result in privilege escalation or denial of service. The CVSS score of 7.8 indicates high severity, and an EPSS score of < 1% shows low current exploitation probability. The issue is not listed in the CISA KEV catalog, and the lack of bounds checking signifies a high severity within affected kernel environments.