Kernel-handled Remote Management Messaging Protocol (RMPP) responses can be accepted before they are matched to an existing transaction. The code that reassembles incoming RMPP data begins processing an unsolicited response that contains a spoofed or malformed transaction identifier, allocating kernel state before the source address and transaction ID are verified. This race condition allows an attacker to repeatedly trigger the creation of RMPP receive buffers without any corresponding send, potentially exhausting memory or processing resources and denying service to legitimate traffic. No remote code execution, data leakage, or privilege escalation is possible through this flaw, but the impact is a resource exhaustion attack.

The vulnerability applies to all Linux kernel implementations that support IB/mad RMPP handling. The CPE indicates the generic Linux kernel, and no specific affected versions are enumerated in the raw data.

The CVSS score is not disclosed, and no EPSS score is available, so the absolute severity is unquantified. The flaw is listed as not in the CISA KEV catalog. Because the bug allows an attacker to generate amplified traffic to the kernel, it is classified as a local denial of service that could be triggered from network traffic. Exploitability is plausible where the attacker can send crafted RMPP packets to a target system that has the RMPP feature enabled.