The flaw in the Linux kernel’s RDMA core module treats Netlink attributes of type NLA_STRING as plain C strings without validating the terminating NUL character. When the code passes these attributes to functions like strcmp and printf with a %s specifier, a crafted payload that lacks a null terminator causes the kernel to read beyond the allocated buffer, creating an out-of-bounds read that may allow kernel memory disclosure. This weakness matches CWE‑125 and CWE‑170 and is limited to the RDMA messaging subsystem.

All Linux kernel releases containing the legacy RDMA core code that has not applied the NLA_NUL_STRING patch are vulnerable. The issue exists across all current releases that still handle NLA_STRING in the same unprotected way. Any system running a kernel with that unpatched logic—particularly those using RDMA for network or storage traffic—is at risk. No specific version range is identified, so all current kernel distributions that have not incorporated the patch are susceptible.

The CVSS score of 8.4 reflects a high severity impact. The EPSS score of less than 1 % indicates that exploitation of this flaw is currently uncommon. Based on the description, it is inferred that the attack vector would involve the injection of crafted Netlink messages from a local or elevated privilege context, or from a compromised RDMA client. While the vulnerability is not listed in CISA’s KEV catalog, the kernel’s privileged nature means that a successful exploitation could potentially provide kernel-level access.