In the Linux kernel's RDMA/rxe subsystem, the free_rd_atomic_resources() function incorrectly assumes qp->attr.max_dest_rd_atomic stays unchanged while deallocating an array. If this attribute is changed before the old array is freed, the function walks beyond the bounds of the original allocation and writes past the buffer. The out‑of‑bounds write can corrupt kernel memory structures, leading to data loss, system instability, or providing an attacker with a foothold for privilege escalation. This flaw is an out‑of‑bounds memory access, which falls under CWE‑787.

All Linux kernel installations that include the RDMA/rxe driver before the commit that fixes the out‑of‑bounds bug are vulnerable. This includes any kernel version that contains the unpatched rxe_qp.c source and supports RDMA verbs. No specific vendor or product release information is available beyond the generic Linux kernel identifier, so any unpatched Linux kernel running RDMA/rxe should be considered at risk.

Kernel memory corruption of this type is highly damaging, because it occurs in privileged kernel space. The exploitation requires local RDMA access; an attacker who can issue RDMA verbs, such as a privileged user or a malicious RDMA application, could trigger the bug. No publicly documented exploits are known, and the vulnerability is not listed in CISA KEV. The EPSS score is <1%, indicating a very low but nonzero exploitation probability, and the CVSS score of 7.3 reflects significant impact on confidentiality, integrity, and availability.