In the Linux kernel, the rpcrdma module misprocesses short or malformed replies from a remote client. A zero‑length peek allows the kernel to read beyond the end of the receive buffer, which can read up to 20 bytes of stale data and misclassify the reply as a backchannel request. This misclassification causes the reply buffer to be orphaned and never freed. As a result, the kernel’s receive queue can drain, leading to Receive‑Not‑Ready (RNR) NAKs that impair network performance. The vulnerability can be exploited remotely by an attacker who can send crafted RPC replies, potentially causing a denial of service. Affected Systems The bug affects the Linux kernel itself; no specific version range is provided in the CVE data, so all kernel builds that include the rpcrdma module before the commit that fixes the issue are potentially vulnerable. Risk and Exploitability The CVE lacks an assigned CVSS score or EPSS probability, but the conditions required for exploitation—delivery of a malformed RPC reply over RDMA—are achievable by anyone with network access to the kernel’s RDMA interface. No CISA KEV flag has been set, yet the impact level is high because an unpatched system can be taken down by a remote attacker. The exploit path is therefore a remote attack via the RDMA channel.

Linux kernel releases that include the rpcrdma module before the patch commit

Because no CVSS or EPSS values are available, the severity must be judged from the described impact. The vulnerability permits a remote attacker, typically over a network using RDMA, to trigger out‑of‑bounds reads and drain the receive queue, leading to a denial of service. The lack of an EPSS score suggests no known widespread exploitation, but the potential for remote disruption is significant, especially in environments that rely on RDMA for performance.