The flaw in the Linux kernel’s RDMA core module treats Netlink attributes of type NLA_STRING as plain C strings without validating the terminating NUL character. When the code passes these attributes to functions like strcmp and printf with a %s specifier, a crafted payload that lacks a null terminator causes the kernel to read beyond the allocated buffer, creating an out-of-bounds read that can lead to kernel memory corruption. This weakness matches CWE‑125 and is limited to the RDMA messaging subsystem.

All Linux kernel releases containing the legacy RDMA core code that has not applied the NLA_NUL_STRING patch are vulnerable. The issue exists across all current releases that still handle NLA_STRING in the same unprotected way. Any system running a kernel with that unpatched logic—particularly those using RDMA for network or storage traffic—is at risk. No specific version range is identified, so all current kernel distributions that have not incorporated the patch are susceptible.

The CVSS score of 8.4 reflects a high severity impact. The EPSS score of less than 1 % indicates that exploitation of this flaw is currently uncommon. An attacker would need the ability to inject malformed Netlink messages, which typically requires local or elevated privileges, or a compromised RDMA client that can send crafted attributes. While the vulnerability is not listed in CISA’s KEV catalog, the kernel’s privileged nature means a successful exploitation could allow privilege escalation to kernel level.