The rpcrdma reply handling path in the Linux kernel fails to clamp the credit grant field after it is parsed from the network packet. When an incoming reply carries an unknown transaction ID and an inflated credit value, the kernel allocates and posts Receive Work Requests (WRs) that exceed the configured maximum. This unchecked allocation loop can consume excessive memory and CPU, potentially exhausting kernel resources and causing the system to become unresponsive. The flaw is a classic example of unvalidated input leading to uncontrolled resource consumption and results in a denial of service when triggered by a malicious peer.

Linux kernel builds that have not incorporated the commit that sanitizes the credit grant immediately after parsing are affected. Any distribution that ships with the unpatched rpcrdma code is susceptible; the vulnerability exists across all kernel releases before the fix, irrespective of distribution‑specific versioning. Systems that enable the rpcrdma RPC subsystem and accept remote RPC traffic are at risk.

The vulnerability is exploitable over the network; a hostile actor can send a crafted RPC reply containing an arbitrary XID and inflated credit grant to a target running the vulnerable kernel. The EPSS score is <1% and the issue is not listed in the CISA KEV catalog; the CVSS score of 7.5 indicates high severity, yet the lack of widespread exploitation does not diminish potential for high‑impact resource exhaustion. Attackers require network access to the RPC service but do not need privileged operating‑system access, making the exploit path relatively easy to abuse in environments where rpcrdma traffic is not tightly controlled.