In the Linux kernel, the RDMA/rxe driver performs a range check for registered memory regions. The original check used unchecked 64‑bit addition, allowing attacker‑specified values near the maximum address to wrap around to zero. This bypasses the validation and causes an out‑of‑bounds index calculation in rxe_mr_copy_xarray(), resulting in a kernel oops that can be triggered by an unauthenticated remote peer. The impact is a denial of service, as the kernel will crash and restart, with no documented privilege escalation or data leakage.

The vulnerability applies to all Linux kernel builds that include the RDMA/rxe driver and have not applied the commit that patches mr_check_range(). Because the affected kernel versions are unspecified, any system running a kernel before the patch is vulnerable, including open‑source distributions and embedded systems.

The CVSS score of 9.8 indicates a high severity. The EPSS score of less than 1% shows a very low but nonzero chance of exploitation, and the issue is not listed in CISA’s KEV catalog. The attack vector is network‑based; a remote peer can send specially crafted RDMA‑Write or RDMA‑Read RETH messages to trigger the overflow. Successful exploitation leads to a kernel oops, causing a system reboot or crash. No publicly released proof‑of‑concept exploits are available, but the underlying flaw is a classic integer overflow leading to out‑of‑bounds access.