The flaw arises in the Linux kernel's RDMA rtrs server when a network‑supplied usr_len value is subtracted from an offset without bounds checking. If an attacker sets usr_len larger than the offset, the subtraction underflows, producing a very large size_t value that is passed to the rdma_ev callback as a memory length. This can cause an out‑of‑bounds memory access, corrupting kernel memory and potentially leading to denial of service or privilege escalation, but does not grant immediate code execution on its own.

Affected systems are all Linux kernel installations that have not yet incorporated the commit c76e9123 (or earlier versions of the rtrs server). Virtually any distribution distributing an unpatched kernel is at risk, regardless of specific vendor or kernel release, until the patch is applied.

The CVSS and EPSS metrics are not provided and the issue is not listed in the CISA KEV catalog, which suggests no documented exploitation yet. The vulnerability is exploitable remotely via RDMA traffic, and an attacker must be able to send malformed RDMA messages to the target. Given that RDMA is typically exposed only in controlled environments, the likelihood of exploitation in the wild is moderate, but the impact of successful exploitation is high because kernel memory corruption can lead to system instability or privilege escalation. Administrators should treat it as a high‑impact, moderately likely risk.