This bug in the Linux kernel’s RDMA bnxt_re driver causes the dpi variable to be initialized only for a specific operation window and then copied for other operations. As a result, the driver may propagate an uninitialized value, leading to unpredictable behavior and the potential leakage of sensitive kernel memory contents. The flaw falls under the category of using uninitialized data, which can compromise data confidentiality and integrity within the kernel.

The affected product is the Linux operating system kernel. No specific kernel build numbers are listed; the vulnerability applies to any kernel version that includes the bnxt_re RDMA module prior to the official fix in the referenced commit.

The CVSS or EPSS metrics are not provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need local kernel access to exploit this flaw, likely in environments that enable RDMA operations using the bnxt_re driver. Because the flaw involves an uninitialized variable, exploitation risk is mainly limited to information disclosure rather than remote code execution. The absence of public exploitation evidence suggests a moderate overall risk, but any system relying on RDMA via bnxt_re should patch promptly to eliminate the uncertainty.