CVE-2026-72499

A flaw was found in the Linux kernel's RDMA/bnxt_re component. During firmware teardown, a memory page is prematurely freed. An NQ interrupt arriving at this time can write data to this already-freed memory, leading to memory corruption. This could potentially result in a system crash or other unpredictable behavior.

RDMA bnxt_re can hit a use-after-free style write because the CQ toggle page was freed before firmware CQ teardown completed. An NQ interrupt arriving during bnxt_qplib_destroy_cq can still write the toggle value into the already freed page, so a freed page could be corrupted or the kernel could crash. For the CVSS the PR:L is used because a local user or service with access to RDMA uverbs device nodes may be able to create and destroy CQs without full host administrator privileges. The issue is not network reachable in the generic CVSS sense and requires local access to the RDMA device interface, although the affected hardware is commonly used for RoCE or data center RDMA workloads. Impact is at least local denial of service and the freed page write makes limited confidentiality or integrity impact defensible for base scoring.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.