A local, unprivileged user can invoke the AF_RDS socket family over a RDMA-capable network device, open a connection and query the remote RDMA connection information through the RDS_INFO_IB_CONNECTIONS socket option. The kernel fails to initialize a per-item buffer used by the visitor callbacks, so the buffer contains remnants of the stack, including kernel text and data pointers. The uninitialized bytes are copied to user space through memcpy_to_user(), resulting in a leakage of kernel memory contents. This constitutes an information disclosure vulnerability allowing an attacker to read arbitrary kernel addresses, potentially aiding further exploitation.

All Linux kernel implementations that expose the RDS (Reliable Datagram Sockets) interface over RDMA before the resolution implemented in the patch referenced in the CVE description. The bug exists in versions that do not zero the per-item buffer in rds_for_each_conn_info() or rds_walk_conn_path_info(). No specific kernel version range is supplied in the CVE data, so any unpatched kernel that supports AF_RDS on RDMA devices is at risk.

The CVSS score is not provided in the CVE data, and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog. The documented attack requires only local, unprivileged privileges and the presence of an RDMA-capable network device, making the attack vector easily achievable on any host where RDS is enabled. Because the vulnerability leaks kernel pointers, it could expose information useful for subsequent attacks, though it does not directly grant code execution or privilege escalation. The risk is therefore considered moderate to high for systems that allow RDS usage in this context, especially if the kernel contains other side‑channel or privilege escalation flaws that could be combined with this information disclosure.