The vulnerability in the Linux kernel RDMA/rxe driver arises from insufficient validation of the num_sge and cur_sge fields in user-submitted Work Queue Elements (WQEs). Specifically, for user Queue Pairs (QPs), the application writes directly to qp->sq.queue, and the kernel does not validate these fields before indexing the wqe->dma.sge[] array. This allows an attacker to post a WQE with out-of-range cur_sge or an oversized num_sge, causing an out-of-bounds read in the kernel's vmalloc area during copy_data(). The vulnerability can lead to a local denial of service. The fix bounds num_sge to qp->sq.max_sge and cur_sge is bounded when the WQE carries payload, preventing out-of-bounds access. The fix has been verified under KASAN with no further out-of-bounds reads.

A local unprivileged user can exploit this vulnerability to cause an out-of-bounds read in kernel memory, leading to a local denial of service (DoS). The CVSS score of 7.1 reflects high severity due to the potential for denial of service and high confidentiality impact, although no integrity impact is indicated. There is no evidence of remote exploitation or privilege escalation from the provided data.

A fix is available that adds proper bounds checking on num_sge and cur_sge fields before indexing the sge array in the RDMA/rxe driver. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation. No additional mitigations are indicated by the vendor advisory.