The vulnerability resides in the RDMA/srpt subsystem of the Linux kernel. A user‑controlled 32‑bit field named imm_buf->len, when combined with imm_data_offset, can overflow without bounds checking. An attacker can send a length of 0xffffffff, causing the calculated request size to wrap around to a very small value, thus bypassing the bounds check and ultimately passing an ostensibly 4 GB length to sg_init_one. This leads to kernel memory corruption and, as a result, remote code execution. The weakness is an integer overflow that turns into a buffer overflow.

Affected systems include all Linux kernel builds that contain the RDMA/srpt driver prior to the inclusion of the fix. The specific commit that resolves the issue can be found in the listed kernel git URLs. No explicit version range was provided, so any kernel from the current development tree before the patch is potentially vulnerable.

The CVSS score is 9.8, and the EPSS score indicates a very low exploitation probability (< 1 %). The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on network communication to the target. An attacker would need to transmit a malformed RDMA packet that triggers the overflow. Because the flaw lies in a privileged kernel component, successful exploitation would elevate an attacker’s privileges to cover the entire system. With the available exploitation data, the risk remains high for exposed RDMA interfaces, especially in untrusted environments.