The vulnerability resides in the Linux kernel’s RDMA/rxe subsystem, where the conversion from I/O virtual address (IOVA) to kernel virtual address (VA) incorrectly handles memory regions (MRs) whose page sizes differ from the system PAGE_SIZE. This mis‑indexing can cause the kernel to reference an incorrect system page, resulting in invalid address translation and leading to a kernel panic. The flaw is a classic memory corruption issue (CWE‑823), which, while not providing direct code execution, can disrupt system availability by crashing the kernel.

All Linux kernel installations that include the unpatched RDMA/rxe driver are affected. The patch is incorporated into recent kernel revisions; distributions should verify that their kernels contain the commit that replaces the page conversion logic. No specific kernel version is listed, so any system running an older kernel that has not yet applied the fix is potentially vulnerable.

The CVSS score of 7.0 places this issue in the high severity range. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits have been reported yet. Based on the description, it is inferred that the attack vector likely involves an attacker crafting RDMA operations with non‑standard page sizes to trigger the faulty translation logic. An attacker with the ability to initiate RDMA operations—either locally or remotely via an exposed RDMA/RPC interface—could craft memory registrations with non‑standard page sizes to trigger the faulty translation logic, leading to a denial of service. The attack requires control over RDMA traffic or a local privilege escalation to influence memory mapping. Given current data, the likelihood of exploitation is low but not negligible.