CVE-2026-72500

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) Broadcom NetXtreme-E (bnxt_re) driver. This use-after-free vulnerability occurs because a specific memory page is released prematurely during the teardown process. A local attacker could exploit this timing issue, potentially leading to memory corruption and a denial of service.

A race in the bnxt_re RDMA SRQ destroy path can free the userspace visible SRQ toggle page before firmware teardown has completed. If an NQ interrupt arrives during bnxt_qplib_destroy_srq(), the driver can write toggle values into an already freed page, creating a use after free memory corruption condition. For the CVSS the PR:L is used because a local process generally needs access to RDMA uverbs or equivalent device permissions to create and destroy SRQs. The issue is not directly network reachable because a remote peer normally cannot destroy the local SRQ, although RDMA activity and device interrupts may influence timing. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.