The RDMA/rxe subsystem in the Linux kernel processes work queue entries (WQEs) for non‑SRQ queue pairs by copying fields directly from a userspace‑mapped shared buffer. Because the number of SGE descriptors and the SGE entries themselves are not validated, an attacker can modify these fields while the kernel processes the WQE. The kernel then performs out‑of‑bounds reads in rxe_resp_check_length() and copy_data(), which may expose sensitive kernel memory. This flaw does not immediately grant code execution, but it could be leveraged for information disclosure or privilege escalation when combined with other weaknesses.

All Linux kernel builds that include the rxe RDMA driver and have not applied the get_recv_wqe() patch are affected. The vulnerability is present in any kernel version before the patch that validates num_sge and copies the WQE into a kernel‑local buffer.

The CVSS score of 7.8 indicates medium‑high severity, and the EPSS score of 0.172% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA KEV. Based on the description, it is inferred that the attack vector requires the adversary to have userspace privileges that allow creation or manipulation of RDMA queue pairs, typically through CAP_SYS_RAWIO or equivalent capabilities. Once a malicious WQE is established, the kernel will perform out‑of‑bounds reads. Assuming no additional vulnerabilities, the immediate risk is limited to memory exposure, but future or coupled exploits could raise the severity.