CVE-2026-92495

A flaw was found in the Linux kernel's RDMA/bnxt_re component. A read-only memory mapping (mmap) for DBR/toggle pages can incorrectly retain write permissions (VM_MAYWRITE). This allows a local attacker to bypass intended security checks and upgrade the mapping to writable using mprotect(PROT_WRITE). Consequently, an attacker could gain unauthorized write access to these memory regions, potentially leading to privilege escalation.

The bnxt_re RDMA driver rejected writable mmap requests for DBR and toggle pages, but a read-only mapping could still retain VM_MAYWRITE and later be upgraded with mprotect(PROT_WRITE). This bypasses the driver policy that these pages are not expected to be written from userspace and may allow a local RDMA user to modify device related shared state. For the CVSS the PR:L is used because an attacker needs local access to the RDMA userspace interface or an allowed uverbs context, but does not need full administrator privileges in deployments where RDMA device access is delegated. The issue is not directly network reachable and is triggered through a local mmap plus protection change path rather than packet traffic. Impact is primarily integrity policy bypass and denial of service risk for the affected RDMA context or device, with no clear evidence of arbitrary kernel memory write or privilege escalation from the patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.