The flaw resides in the RDMA rxe subsystem of the Linux kernel. An earlier patch removed a check that verified a page‑frame number was writable (HMM_PFN_WRITE); only a validity test remained. The result is that an unprivileged user can map a read‑only file, such as "/etc/passwd" or a set‑UID binary, into an Out‑of‑Order Data (ODP) memory region and then cause RDMA write operations to overwrite those pages via kmap, bypassing the normal write protection. This violates the principles of improper authentication (CWE‑281) and can lead to local privilege escalation by corrupting privileged files.

All Linux kernel installations that use the rxe RDMA stack and have not incorporated the commit restoring the HMM_PFN_WRITE check are vulnerable. Because the fix was introduced in the mainline kernel, any distribution running a kernel version prior to the remediation—regardless of its release line—may be impacted. The weakness affects the kernel component itself rather than any particular user‑space program.

The vulnerability carries a high severity impact, reflected by a CVSS score of 7.8, and the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. However, the consequence of overwriting protected files such as "/etc/passwd" or set‑UID binaries makes the flaw comparable to Dirty COW, enabling local privilege escalation. The flaw is not listed in the CISA KEV catalog. Exploitation requires that RDMA traffic reach the vulnerable interface; the attacker must be able to register an ODP memory region that maps a read‑only file. The likely attack vector, based on the description, is either local or network‑based RDMA traffic reaching the target system.