A signed integer overflow vulnerability in the Linux kernel RDMA/mlx5 driver poses a significant risk for local privilege escalation and system compromise.

The flaw resides in the set_user_buf_size function within the RDMA/mlx5 driver, where arithmetic operations on user-supplied parameters result in a signed integer overflow. This allows an authenticated local user to force the allocation of an undersized memory buffer, leading to out-of-bounds writes when the hardware interacts with the buffer.

Successful exploitation of this vulnerability allows a local attacker to manipulate kernel memory, which can lead to a full system compromise. Given the CVSS score of 7.8, this vulnerability represents a high-severity risk that could facilitate unauthorized privilege escalation, data exfiltration, or total system instability, directly impacting the availability and integrity of critical infrastructure.

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainers, ensuring the kernel is updated to at least version 5.10.270, 5.15.221, 6.1.188, or 6.6.157.

Proactive Monitoring: Monitor system logs for kernel-related crashes or memory-related errors, specifically those originating from RDMA or mlx5 hardware driver modules.

Compensating Controls: Restrict access to the RDMA subsystem and limit local user permissions to prevent unauthorized interaction with kernel-level interfaces.

Public Exploit Available: Unknown

The severity of this kernel-level flaw necessitates immediate attention from systems administrators. Because this vulnerability allows for memory corruption at the kernel level, the risk of privilege escalation is high. Organizations should prioritize updating their Linux kernels to the verified fixed versions and restrict access to sensitive hardware interfaces to mitigate potential exploitation attempts.