A flaw in the Linux kernel’s NFS/RDMA subsystem allows a locally privileged or unprivileged user to trigger a null pointer dereference by causing the creation of the write‑pad memory region to fail during a client connection. The failure is ignored by the connection routine, and a subsequent RDMA read attempts to use the uninitialized memory region, leading to a kernel panic. The vulnerability does not provide arbitrary code execution but forces a crash when an NFS/RDMA client connects or reconnects.

All Linux kernel releases that contain the vulnerable frwr_wp_create() path are affected; specific product versions are not enumerated in the advisory, so any kernel prior to the patch must be considered vulnerable. The issue impacts systems running the NFS over RDMA protocol.

This exploit requires local access to the NFS/RDMA client and is triggered by internal memory allocation failures, which are generally uncommon but possible in resource‑constrained or misconfigured environments. Because the attacker cannot control the remote peer, the exploitation vector is local only. With an EPSS score of < 1%—indicative of a very low exploitation probability—and a CVSS score of 5.5, and the vulnerability not listed in the KEV catalog, the overall likelihood of exploitation is uncertain but should be treated as a moderate risk, especially for systems that use NFS/RDMA frequently.