The Linux kernel’s RDMA/mad subsystem contains a flaw where a receive buffer is not freed when PKey enforcement fails. During ib_mad_complete_recv() the buffer is linked to the list only after the failure path, leaving the buffer allocated each time a MAD with an incorrect PKey is processed. Each leak consumes about 300 bytes per interface per MAD, growing to 2 KB for OPA on a per-port basis. Repeated malicious MADs could exhaust kernel memory and destabilize the host, resulting in service degradation or crash. It is a resource consumption flaw. Based on the description, the likely attack vector is a remote RDMA connection where a malicious node sends malformed MAD packets with incorrect PKey values.

The vulnerability exists in all versions of the Linux kernel that include the RDMA/mad subsystem prior to the patch introduced in commit 3476c28c9addfa253f505e6bd87f1f5598b961d0 and its follow‑up commits referenced in the advisory. It affects any system that has RDMA active, regardless of vendor, as the product is the Linux kernel itself.

The CVSS score is 5.5. The EPSS score is <1% and the issue is not listed in CISA’s KEV catalog. The flaw is exploitable from a remote RDMA connection; this inference is drawn from the description that the problem occurs while processing incoming MAD packets. The attacker does not need elevated privileges on the target but must control RDMA traffic. An attacker with network access to the RDMA fabric can repeatedly send malformed MAD packets to accumulate leaks, increasing kernel memory pressure. The resulting denial of service may manifest as degraded performance or kernel crashes, presenting a high risk to affected systems.