The flaw occurs during the calculation of receive queue (RQ) work queue element (WQE) size in the Linux kernel RDMA/mlx5 driver. The calculation uses a left shift based on a user‑provided value that is only checked to be greater than 32, allowing shifts of 32 or 31. Shifting a signed integer by 31 bits overflows, leading to undefined behavior inside the kernel. Undefined behavior can manifest as incorrect memory access or corruption, potentially causing system instability, denial of service, or further security breaches. The impact is therefore tied to kernel reliability and integrity.

All Linux kernel releases that include the RDMA/mlx5 driver before the patch were affected. The vulnerability exists in the kernel’s RDMA subsystem, and any kernel image that accepts the user‑provided shift value without proper bounds checking could exercise the defect. The exact version range is not specified, but any kernel prior to the commit that introduced the fix is susceptible.

The CVSS score is 7.8, EPSS score < 1%, so the exploitation probability remains low, but the high severity indicates significant risk. The vulnerability is not listed in CISA KEV catalog. Based on the description, the likely attack vector involves an application that configures the RDMA device with a user‑supplied rq_wqe_shift value. A malicious actor could supply a large shift to trigger the undefined behavior, potentially causing a kernel panic or memory corruption. Administrators should treat the risk as significant due to the kernel-level impact, especially in environments that rely on RDMA services.