The irdma_copy_user_pgaddrs function in the Linux RDMA driver incorrectly checks the loop termination condition when the allocated DMA block count is zero, allowing the loop to continue past the fixed-size pgaddrmem array. This out‑of‑bounds write could overwrite adjacent kernel memory, potentially leading to arbitrary code execution or system instability if an attacker controls the RDMA input. The vulnerability is a classic buffer overflow in kernel space where the fault originates from an unchecked write.

The flaw exists in the Linux kernel’s irdma driver, which is used on all distributions that ship the driver without the applied patch. No specific kernel version list is provided, so any kernel containing the old irdma code that has not incorporated the patch is vulnerable. Systems that expose RDMA interfaces to untrusted code are at risk.

The EPSS score is < 1%, and the flaw is not listed in CISA’s KEV catalog, suggesting no known public exploits yet. However, the out‑of‑bounds write occurs in a device driver that runs with kernel privileges, so a local or remote attacker who can create RDMA resources could exploit the overflow to gain elevated privileges or crash the system. The CVSS score of 7.8 indicates high severity, reflecting the potential for privilege escalation or system instability. The attack vector is inferred to be local or remote through RDMA, but verification is required to determine exact prerequisites.