The Linux kernel RDMA ionic driver had a vulnerability where the node_desc field in struct ib_device, a 64-byte array, was not guaranteed to be NUL-terminated after a write via the node_desc sysfs file. The core IB sysfs handler used a bounded format specifier "%.64s" to safely read this field, but the ionic hca_type_show() handler used an unbounded "%s", causing it to read past the end of node_desc into adjacent memory until a NUL byte was found. Since ionic supports modification of node_desc from userspace, this could be triggered by a local user. The fix involved bounding the format specifier in ionic to prevent out-of-bounds reads.

The vulnerability allows a local user with permission to modify the node_desc sysfs file to cause the kernel to read beyond the intended buffer, potentially leading to information disclosure or kernel memory corruption. The CVSS vector indicates no confidentiality or integrity impact but an availability impact (denial of service). No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to bound the format specifier in the ionic driver, preventing out-of-bounds reads. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or kernel mailing lists for the specific fixed version.