The Linux kernel’s RDMA/siw subsystem fails to validate the MPA length field in an iWARP FPDU. An attacker can send an FPDU with a length smaller than the protocol’s header size, causing signed arithmetic to underflow and produce a negative value that, when cast to an unsigned size, becomes a huge read. This out‑of‑bounds read can crash the kernel or, in a real exploit, corrupt memory and lead to remote code execution. The vulnerability stems from improper bounds checking and signed‑to‑unsigned conversion errors.

All Linux kernel implementations that include the siw driver are affected, regardless of distribution or version, until the patch that adds the missing invariant is applied. The exact impact range is limited to machines that expose RDMA/siw endpoints to potentially malicious peers, which includes servers and high‑performance computing nodes that use iWARP.

The CVSS score of 9.8 indicates a severe impact and high exploitability, while the EPSS score of <1% shows that it is currently considered unlikely to be widely exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, but its potential for kernel compromise makes it critical for environments that rely on RDMA. A remote attacker who can open an siw connection and send malformed packets can trigger the underlying integer underflow, leading to kernel panics or, if attacker control is sufficient, code execution. The attack vector is network‑based, requiring knowledge of the target’s RDMA services and the ability to inject custom iWARP packets.