The flaw arises in the Linux kernel's RDMA rtrs server when a network‑supplied usr_len value is subtracted from an offset without bounds checking. If an attacker sets usr_len larger than the offset, the subtraction underflows, producing a very large size_t value that is passed to the rdma_ev callback as a memory length. This can cause an out‑of‑bounds memory access, corrupting kernel memory and potentially leading to denial of service or privilege escalation, but does not grant immediate code execution on its own.

Affected systems are all Linux kernel installations that have not yet incorporated the commit c76e9123 (or earlier versions of the rtrs server). Virtually any distribution distributing an unpatched kernel is at risk, regardless of specific vendor or kernel release, until the patch is applied.

The CVSS score of 9.8 classifies this vulnerability as Critical, and, although the EPSS score of 0.452% and the vulnerability is not listed in the CISA KEV catalog, the high score indicates that exploitation would have severe impact on confidentiality, integrity, and availability. The vulnerability is exploitable remotely via RDMA traffic, and an attacker must be able to send malformed RDMA messages to the target. Because RDMA is typically exposed only in controlled environments, the likelihood of exploitation in the wild is moderate, but successful exploitation would likely lead to kernel memory corruption, service disruption, and privilege escalation.