The vulnerability arises because the 64‑byte node_desc field in the RDMA ionic driver’s ib_device structure is not guaranteed to be NUL‑terminated. When a user writes exactly 64 bytes to the node_desc sysfs file, the kernel copies the data without adding a terminating NUL. Subsequently, the ionic driver’s hca_type_show() routine prints that string using an unbounded "%s" format specifier, causing the kernel to read past the array boundary into adjacent memory. This buffer overread can reveal arbitrary kernel memory contents, including potentially sensitive data, and is the manifestation of a CWE‑125 flaw.

All variants of the Linux kernel that incorporate the RDMA ionic driver and have not applied the fix that bounds the format specifier are affected, regardless of the kernel release series. Any system that loads the ionic module before the patch is installed is vulnerable.

The vulnerability has a CVSS score of 5.5, indicating moderate severity. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local; a user with write access to the node_desc sysfs file, typically requiring root or CAP_SYS_ADMIN privileges, can trigger the overread. No evidence indicates that remote exploitation or privilege escalation is achievable through this flaw. Based on the description, it is inferred that the vulnerability is exploitable only by users with sufficient local privileges to modify the node_desc entry.