The Linux kernel’s ib_get_ucaps() function validates the file operations passed to it only by checking the device type identifier. This approach allows a local user who can create a block device to craft a device that shares the same dev_t as the expected character device. When the kernel then treats this block device as an RDMA user capabilities device, it may invoke kernel operations on an unintended device, leading to unauthorized use of RDMA interfaces. This flaw is an instance of improper enforcement of access control (CWE-285). The impact is that an attacker could gain unapproved access to RDMA capabilities, potentially affecting confidentiality and integrity of data transmitted through RDMA channels.

The flaw exists in Linux kernel versions 7.1 rc1 through rc7, as well as any derivative kernels that include the RDMA core subsystem without the patch that validates fops in ib_get_ucaps().

CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation at this time. Because the fault requires a local user to craft a block device that impersonates the RDMA character device, the attack vector is local. The vulnerability is not currently listed in the CISA KEV catalog, so no large-scale exploitation has been observed yet. Nevertheless, the combination of high impact and the possibility of local exploitation warrants prompt attention, especially on systems where RDMA is enabled and the kernel version is known or unknown to be fixed.