In the Linux kernel, a bug in the RDMA uverbs write path can cause the kernel to dereference an uninitialized method_elm pointer from a legacy bundle that lacks an ioctl method element. When malformed provider input triggers the common uverbs validation to emit an error, uverbs_get_handler_fn() attempts to dereference this dangling pointer, which leads to a kernel crash. The crash results in a denial of service through a kernel panic, representing a significant disruption for affected systems.

All Linux kernel builds that expose RDMA uverbs interfaces without the patch are potentially impacted. Because no vendor‑specific version list is supplied, any distribution running an unpatched kernel may be affected. The vulnerability is present in the core uverbs implementation used by RDMA drivers.

The CVSS score of 4.7 and an EPSS score of < 1% indicate moderate severity. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to supply malformed RDMA bundles to the uverbs subsystem, which generally requires local or privileged access to RDMA devices. The potential impact is a kernel crash that denies service; no remote code execution or confidentiality impact is described. The attack vector is inferred because the description does not explicitly state it, but the nature of the bug suggests it requires local RDMA provider interaction.