A critical out-of-bounds read vulnerability in the Linux kernel RDMA/rxe subsystem allows local users to cause memory corruption or system denial of service.

The flaw exists in the RDMA/rxe driver, which fails to validate num_sge and cur_sge parameters provided by user-space applications. An attacker with local, low-privileged access can craft a WQE (Work Queue Element) that forces the kernel to perform an out-of-bounds read of the per-WQE sge array.

The vulnerability poses a high risk to system stability and data confidentiality. By triggering an out-of-bounds memory read, a local attacker can cause a kernel panic (denial of service) or potentially leak sensitive information from kernel memory. Given the CVSS score of 7.1, this represents a significant threat to multi-tenant environments where local user isolation is critical for security.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.52, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel oops or KASAN-related reports which may indicate attempts to exploit memory safety vulnerabilities.

Compensating Controls: Restrict access to RDMA interfaces and ensure only trusted users have the ability to interact with the rxe driver, if possible.

Public Exploit Available: Unknown

System administrators should prioritize patching the Linux kernel to the identified secure versions. Because the vulnerability allows local privilege escalation or denial of service through memory corruption, it is essential to ensure that kernel updates are applied across all production environments to prevent local attackers from abusing the RDMA subsystem.