The Linux kernel’s RDMA bnxt_re driver can leak a kernel pointer, mr_hwq, when users run the rdma tool to view memory registrations. This exposes the address of kernel memory to end‑users, potentially helping an attacker learn the layout of kernel address space. The information that is disclosed is strictly the pointer value; the vulnerability does not provide an immediate means to execute code or modify system state.

All Linux kernel releases that have not yet applied the patch that removes the mr_hwq value from rdma output. The vulnerability sits in the generic Linux kernel, specifically in the bnxt_re RDMA driver.

The CVSS score of 5.5 indicates moderate severity for an information‑disclosure flaw. The EPSS score of <1% shows that usage of this vulnerability by an attacker is currently considered very unlikely. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or requires an attacker who can run the rdma command on the host; the flaw does not provide a direct execution path. Based on the description, it is inferred that an attacker may use the leaked pointer as part of larger kernel‑address‑leak or side‑channel techniques, but without further exploitation steps the impact remains limited to disclosure.