The vulnerability arises because the node_desc[64] array in struct ib_device may not be NUL-terminated after a raw memcpy operation that copies up to 64 bytes without appending a NUL byte. While the core Infiniband sysfs handler uses a bounded format specifier "%.64s" to safely read node_desc, the ionic hca_type_show() handler uses an unbounded "%s", which can cause it to read past the end of node_desc into adjacent memory until a NUL byte is found. Since ionic supports IB_DEVICE_MODIFY_NODE_DESC, this can be triggered by userspace. The fix bounds the format specifier to prevent out-of-bounds reads.

This vulnerability could lead to information disclosure by reading adjacent memory beyond the node_desc buffer. There is no indication of code execution or privilege escalation. The issue is limited to the ionic RDMA driver in the Linux kernel and requires userspace interaction to trigger.

A fix has been implemented in the Linux kernel to bound the format specifier in the ionic hca_type_show() handler, preventing out-of-bounds reads. Users should update to a kernel version that includes this fix. No other mitigation steps are indicated.