The RDMA subsystem in the Linux kernel does not validate that the new access rights requested by a memory region re‑registration match the existing permissions. When the IB_MR_REREG_ACCESS flag is changed from read‑only to read‑write, the kernel fails to re‑evaluate the associated user memory mapping, which can allow a client to obtain write access to a region that should remain read‑only. This omission creates an improper access control flaw and a failure to enforce required restrictions.

All Linux kernel releases that contain the RDMA stack before the inclusion of the patch commit 09dc188 are affected. This includes kernel 7.1 release candidates from RC1 through RC7 and earlier 7.0 lines. RDMA drivers such as mlx4, which register memory regions without invoking the new ib_umem_check_rereg() helper, are the most directly impacted.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation at present. Exploitation would require a privileged RDMA client that can issue a re‑registration request changing the access flag from RO to RW, and would affect the confidentiality or integrity of data exposed by the kernel's RDMA services. No public exploits have been reported, and the flaw is a kernel‑level missing check rather than a user‑land vulnerability.