The flaw is a null pointer dereference triggered in the RDMA uverbs subsystem when the REG_MR ioctl receives a NULL udata field while the drivers mthca, irdma, and siw expect a non‑null value. The incorrect assumption causes the kernel to crash, resulting in a local denial of service through a kernel classic null dereference weakness, mapped to CWE‑476.

The vulnerability affects the Linux kernel’s RDMA drivers mthca, irdma, and siw. Exact kernel version coverage is unspecified in the advisory; the patch was introduced in commit 011199f46f44a9f. Any kernel build that includes these drivers without the applied patch is vulnerable, regardless of distribution. The issue is not limited to a particular kernel release but to the presence of the unchanged code path.

The CVSS score of 4.7 indicates low‑to‑moderate severity, and the EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. The damage requires a local user with permission to issue RDMA ioctls; remote exploitation without RDMA device access is not feasible. A local attacker can trigger the crash, causing a denial of service.