RDMA/bnxt_re: zero shared page before exposing to userspace

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74584
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 15:16:21 UTC
Updated2026-08-22 15:16:21 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GFP_ZERO, so the page contains stale kernel data from whatever object most recently freed it. The page is then mapped into userspace via vm_insert_page() under BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes 4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed to userspace unsanitised, leaking kernel memory contents. Any user with access to /dev/infiniband/uverbsX on a host with a bnxt_re device (typically rdma group membership) can read this data via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT. Other shared pages in the same file already use get_zeroed_page() correctly: drivers/infiniband/hw/bnxt_re/ib_verbs.c srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL); cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL); uctx->shpg is the only outlier. Bring it in line with the existing convention by switching to get_zeroed_page().

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 53c97e9882f4e747b4ac31b211317c2eba541af9 git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 9896bdfd21d918e9f26a52bc6109cc77970ee0b1 git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 9128c2411b83a64c0a69d2ff059c741bde25a9cc git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 c19b360fa10c521c0b681875cdaa51545d45a491 git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1 git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 e2b143df29003d2704b51f62e9297006953dbacb git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a git Not specified
CNA Linux Linux affected 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 f6b079629becfa977f9c51fe53ad2e6dcc55ef44 git Not specified
CNA Linux Linux affected 4.11 Not specified
CNA Linux Linux unaffected 4.11 semver Not specified
CNA Linux Linux unaffected 5.10.260 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.211 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.177 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.144 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.95 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.37 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.14 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c19b360fa10c521c0b681875cdaa51545d45a491 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9896bdfd21d918e9f26a52bc6109cc77970ee0b1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/53c97e9882f4e747b4ac31b211317c2eba541af9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9128c2411b83a64c0a69d2ff059c741bde25a9cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e2b143df29003d2704b51f62e9297006953dbacb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f6b079629becfa977f9c51fe53ad2e6dcc55ef44 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report