Kernel‑handled Remote Management Messaging Protocol (RMPP) responses are reassembled before they are matched to an existing send request. The code first allocates or extends receive state for each inbound RMPP data segment, only dropping the response later if no matching send can be found. This ordering allows an attacker to send unsolicited RMPP packets that are accepted for state allocation, potentially exhausting kernel memory or processing resources. The flaw reflects a resource‑exhaustion weakness (CWE-400) and involves an improper use of control flow that can lead to unintended state allocation (CWE-179), resulting in denial of service.

The vulnerability applies to all Linux kernel builds that include IB/mad RMPP handling. The CPE string indicates a generic Linux kernel, and no specific version range is listed in the provided data. Consequently, any installed kernel that supports RMPP processing is potentially affected until the patch that drops unmatched responses is applied.

The CVSS score of 7.1 indicates high severity, the EPSS score of < 1% suggests a low probability of exploitation, and the flaw is not included in the CISA KEV catalog. It is inferred that an attacker can trigger the flaw by sending crafted RMPP packets over the network to a target system with RMPP enabled. Because the flaw requires no privileged local access and can be triggered by external traffic, the likely attack vector is remote network. The absence of memory corruption or privilege‑escalation details in the description means no confirmed remote code execution capability is known, and the risk is dominated by potential denial of service through resource exhaustion.