CVE-2026-74584

A flaw was found in the Linux kernel's RDMA/bnxt_re component. A local attacker with access to the RDMA device could exploit this vulnerability due to a failure to zero out a shared memory page before exposing it to userspace. This could lead to information disclosure, allowing the attacker to read sensitive kernel memory contents.

A moderate information disclosure flaw was found in the Linux kernel's RDMA bnxt_re driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10 and the Red Hat In-Vehicle OS kernel streams. In bnxt_re_alloc_ucontext(), the per-user-context shared page is allocated with __get_free_page() and mapped into userspace via vm_insert_page() in bnxt_re_mmap() without being zeroed first; the driver initializes only a 4-byte AVID field, so the rest of the page contains stale kernel data. A local attacker with access to the RDMA userspace verbs device (/dev/infiniband/uverbsX, typically via rdma group membership) on a host with a bnxt_re device could read these uninitialized contents, disclosing potentially sensitive kernel memory. Red Hat Enterprise Linux 6 is not affected because the bnxt_re driver, which contains the vulnerable code, is not present in that release. Fixes for the affected streams are currently deferred to a future update based on the Moderate impact rating; the residual risk is limited to local disclosure of stale kernel memory on systems equipped with the affected Broadcom bnxt_re RDMA hardware. The upstream CVE.org record assigns a higher severity (CVSS 7.1, Important); Red Hat rates this flaw Moderate because exploitation requires local access and RDMA device permissions on hosts with the specific affected hardware, which limits exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.