In the Linux kernel’s RDMA/rxe subsystem, the conversion from an I/O virtual address (IOVA) to a kernel virtual address (VA) incorrectly handles memory regions (MRs) whose page sizes differ from the system PAGE_SIZE. The bug mis‐indexes the page list, causing the kernel to reference an incorrect system page. When an application performs RDMA operations that trigger this code, the resulting address translation error leads to a kernel panic, effectively crashing the system.

All Linux kernel installations that incorporate the unpatched RDMA/rxe driver are vulnerable. The vulnerability is not tied to a specific kernel release; any system running a kernel that lacks the recent commit replacing the page conversion logic can be affected. Distributions should verify that their kernels include the fix before deploying or enabling RDMA interfaces.

The CVSS score of 9.8 categorizes this flaw as critical. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation, and it is not listed in the CISA KEV catalog, meaning no publicly disclosed exploits exist yet. Based on the description, the likely attack vector involves an attacker constructing RDMA operations with non‑standard page sizes to force the faulty translation logic to mis‑index pages. An attacker with the ability to initiate RDMA traffic—potentially through a remote RDMA/RPC interface or local privileged access—could craft such operations and trigger a kernel panic, thereby causing a denial of service. The exploitation requirements and the current lack of public exploits imply that while the risk is high, the likelihood of real‑world exploitation remains low but should not be discounted.