The RDMA/rxe module in the Linux kernel contains a time‑of‑check to time‑of‑use race condition within get_srq_wqe(). The function reads num_sge from a user‑mapped receive queue buffer, verifies it against max_sge, and then rereads num_sge to compute a memcpy size. If a concurrent userspace thread changes num_sge between the two reads, the kernel may copy more data into qp->resp.srq_wqe than the destination buffer can hold, causing a heap buffer overflow. An attacker who can control the RDMA buffer can use this overflow to corrupt kernel memory, potentially leading to privilege escalation or denial of service, as the affected code runs with kernel privileges.

All Linux kernel builds that include the RDMA/rxe component are potentially affected until the fix that copies num_sge into a local variable is applied. The vulnerability description does not list specific kernel release numbers, so any kernel containing the vulnerable RDMA/rxe source should be considered at risk.

The CVSS score of 7.8 indicates a high severity flaw, while the EPSS score of < 1% suggests that exploitation is unlikely but still possible. The vulnerability is not in the CISA KEV catalog, so no public exploit evidence exists yet. The likely attack vector is local: a user‑space process with RDMA permission can manipulate the shared buffer to trigger the race. This inference is derived from the description; the input does not explicitly state the vector. If RDMA services are exposed over a network, a remote actor could potentially achieve the same effect by sending crafted RDMA packets, but this remains speculative based on the data provided.