In the Linux kernel RDMA bnxt_re driver, the WQE mode was not validated against the hardware supported maximum slots, which is 64K, nor against zero. This omission allowed userspace to configure values beyond the supported range, potentially causing the driver to behave unpredictably or crash, resulting in a kernel panic or other denial of service conditions. The vulnerability does not appear to provide a direct code execution path but could be leveraged by an attacker capable of influencing RDMA configuration to destabilize the kernel. Based on the description, it is inferred that the attacker would need to be able to configure RDMA parameters, typically requiring local privileges, to supply an invalid WQE mode that could trigger the fault.

All Linux kernel installations that include the bnxt_re RDMA driver prior to the inclusion of the max slot check. Specific kernel version numbers are not listed in the CVE data, so any kernel revision that contains the unpatched bnxt_re code is considered affected.

The CVSS score is 8.8, and the EPSS score is <1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the flaw relates to internal driver state, exploitation would still likely require local privilege or influence over RDMA configuration. If an attacker can modify the WQE mode value, the driver could be forced into an invalid state leading to a crash, potentially causing a kernel panic and a denial of service. The likely attack vector is local privilege or access to the RDMA configuration. It is inferred that an attacker would need to control the RDMA interface to provide an out-of-range WQE mode. Although no public exploit is known, the high CVSS score underscores the severity if the flaw is triggered.