In the Linux kernel’s svcrdma subsystem, a NULL pointer dereference can be triggered when an attacker sends a read request that pushes the cumulative length of read segments beyond the allocated page budget. The bug allows an attacker to bypass a runtime guard when the segment length exactly matches the page array limit, causing a subsequent segment to access a NULL sentinel slot in the page array during DMA mapping. This results in a kernel crash, providing a straightforward denial‑of‑service vector. The weakness is a classic null pointer dereference, documented as CWE‑476.

All Linux kernel versions that expose the svcrdma RPC over RDMA implementation before the SVCRDMA patch commit are affected. This includes any distribution that has not yet applied the fix found in commit 0ca487abb3bdf581851664b5db21f364caf57682.

Based on the description, the CVSS score of 5.9 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack path requires an attacker to send malformed RDMA traffic to the the description it is inferred that remote attackers who can reach the RDMA endpoint may trigger the crash, while local or privileged attackers could also exercise the payload.