The kernel's ib_get_ucaps() function validates the file operations of a user-provided device without checking the device type, relying solely on the device type identifier. An attacker can create a block device that shares the same device identifier as the expected character device, causing the kernel to treat the block device as the RDMA user capabilities device. This misidentification can allow the attacker to invoke operations on the kernel with the wrong permissions, potentially leading to local privilege escalation or unauthorized actions against the RDMA subsystem.

The flaw exists in the Linux kernel, affecting all deployments that use the RDMA core subsystem and rely on the ib_get_ucaps() function. No specific version range is listed, so any kernel that has not yet been patched for this check is potentially vulnerable.

The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, indicating that widespread exploitation has not been observed yet. However, because the flaw can be triggered by a local user who can craft a specific block device, the risk remains high for systems where RDMA is enabled and the kernel has not been updated. Attackers would need local access or the ability to influence device creation, but once they do, they can gain unauthorized capabilities through the RDMA path.