The vulnerability occurs in the Linux kernel's RDMA SRP subsystem when the routine srp_process_rsp() copies sense data from the SRP target response using a length supplied by the target (resp_data_len). This length is never limited by the actual number of bytes received, leading to a‑bounds read. The copy operation is capped at the maximum sense buffer size of 96 bytes, but the source offset can be far beyond the received data. An attacker who can influence the SRP target can send a response with a very large resp_data_len, causing the kernel to read beyond the bounds of the receive buffer, which may result in a kernel fault or exposure of sensitive kernel memory. This constitutes a CWE‑130 weakness and the primary impact is accidental disclosure of kernel memory contents or denial of service via a crash.

The flaw is present in the Linux kernel; the affected product is the kernel itself on any machine using the RDMA SRP protocol, regardless of distribution or kernel variant. No specific version range is provided, but the issue is fixed in later kernel releases that enforce proper bounds checking on the response length.

An EPSS score of < 1% is available, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires a compromised or malicious SRP target within the InfiniBand/RoCE fabric that the Linux system has logged into. While the attack surface is limited to environments using the SRP RDMA protocol, the lack of bounds validation makes exploitation likely if the attacker can send crafted responses. The risk level is considered high in affected deployments, but the exact exploitation probability remains uncertain due to the low EPSS score.