The vulnerability in the Linux kernel's RDMA/rtrs-srv subsystem involved the rdma_write_sg() function, which constructs the source scatter/gather entry for IB_WR_RDMA_WRITE operations returning data to a peer. The length field used was attacker-controlled and was not properly bounded except for zero-length rejection. The source address and local key used were not tied to the chunk's memory region mapping, allowing the verbs layer to not constrain the transfer length. This could lead to memory corruption or other impacts. The vulnerability was fixed by bounding the RDMA-Write length to the chunk size. The issue affects linux-hwe-edge kernel versions prior to 7.0.0-31.31 and related versions as listed. The CVSS v3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), indicating a network attack vector with high confidentiality and availability impact but no integrity impact. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to fixed package versions.

An attacker can remotely exploit this vulnerability without privileges or user interaction to cause a denial of service (kernel crash) and potentially leak sensitive information due to improper bounds checking in RDMA write operations. The CVSS score of 9.1 reflects high severity with high confidentiality and availability impact. No known exploits are reported in the wild at this time.

A patch is available and has been released by Ubuntu in updated Linux kernel packages. Users should update their systems to the fixed versions listed in the vendor advisory and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigations are indicated by the vendor advisory.