The flaw exists in the Linux kernel’s RDMA/irdma driver. During queue pair creation, the driver populates the page buffer list only when the user supplies a non‑zero user_wqe_bufs value. When the user supplies zero, the page buffer list pointer is later dereferenced without a NULL guard because the guard check is also inside the same conditional. This results in a NULL pointer dereference that can crash the kernel and cause a system reboot, effectively denying service. The weakness is a classic NULL pointer dereference (CWE‑476).

All Linux kernels that include the irdma driver before the fix commit 728211c815f6… are affected. The vendors listed are Linux:Linux, meaning any distribution that ships the upstream Linux kernel with the irdma module compiled. No specific version ranges were provided, so every kernel built with this module prior to the patch is potentially vulnerable.

The CVSS score is not published and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires a user with the ability to send RDMA queue pair creation requests—typically a local user with RDMA device access. The impact is a kernel crash and reboot, which constitutes a denial‑of‑service. No remote code execution or data exfiltration is possible from the information provided.