In the Linux kernel, the XDR parsing routine for RDMA Write and Reply chunks incorrectly accepts a chunk when its segcount field is zero. Because the range check only rejects values greater than the maximum allowed pages, a zero value passes validation, and the decoder returns the current cursor without advancing. The resulting chunk, with a segment count of zero, is linked into the kernel’s internal lists. The likely impact is that a maliciously crafted RDMA packet could introduce an invalid chunk into these lists, potentially confusing later consumers that expect populated segment arrays and leading to kernel crashes or data corruption.

The vulnerability applies to all Linux kernels that have not incorporated the patch commit 45dbdb2637b7fc5f1355b588780d2a7fb0516805. Because the vendor names are listed generically as Linux:Linux, any distribution shipping kernel code without this fix is affected. Systems that enable the RDMA stack, as defined by RFC 8166, are particularly relevant; no specific distribution or kernel version numbers are provided in the record.

The CVSS base score of 9.1 indicates a critical vulnerability with high impact on confidentiality, integrity, and availability. The EPSS score is below 1%, suggesting a low probability of current exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is the transmission of a crafted RDMA packet over a network interface that exposes the RDMA stack; no special privileges on the target are required. While the description does not confirm guaranteed code execution, it indicates that the flaw can be leveraged to cause a denial of service or unintended data handling by the kernel.