The Linux kernel’s NVMe‑RDMA implementation incorrectly handles inline data offsets. Although the bounds check allows any offset where off+len ≤ inline_data_size, the mapping logic assumes the data starts on the first inline page. When inline_data_size exceeds a page and an offset falls between PAGE_SIZE and inline_data_size, the length computation underflows, causing sg->length to become a large value that reads far beyond the intended buffer. The scatter‑list counting also ignores the offset, leading an out‑of‑bounds read to corrupt the scatter list and result in a kernel memory read past the allocated page. Such out‑of‑bounds access can expose sensitive kernel memory or trigger a crash.

All Linux kernel builds that include the nvmet‑rdma subsystem and accept NVMe over RDMA requests are affected, regardless of distribution. The vulnerability exists in any kernel revision that has not incorporated the code changes referenced in the remediation patch series.

With no publicly disclosed exploit, the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.8 indicates critical severity. The flaw permits an out‑of‑bounds memory read in kernel space, which is a high‑severity weakness. The likely attack vector is an attacker gaining the ability to send malformed NVMe‑RDMA requests; this inference is based on the fact that the vulnerability resides in the NVMe‑RDMA command handling path. The read beyond the intended buffer could expose sensitive kernel memory or trigger a kernel crash, potentially leading to a denial‑of‑service. At this time, exploitation would require the attacker to influence inline offset values in the RDMA requests; the extent to which this could lead to privilege escalation is not documented in the CVE description.