{"api_version":"1","generated_at":"2026-10-27T09:04:06+00:00","cve":"CVE-2026-72495","urls":{"html":"https://cve.report/CVE-2026-72495","api":"https://cve.report/api/cve/CVE-2026-72495.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72495","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72495"},"summary":{"title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:23","updated_at":"2026-10-21 13:19:39"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.3","severity":"CRITICAL","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.3","severity":"CRITICAL","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/00c71846874fea4917961236e49287a1850dcf98","name":"https://git.kernel.org/stable/c/00c71846874fea4917961236e49287a1850dcf98","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db","name":"https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217","name":"https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0","name":"https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b","name":"https://git.kernel.org/stable/c/8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72495","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72495","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 360da60d6c6edb9740de7a8e6d8969d62ceff956 8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 360da60d6c6edb9740de7a8e6d8969d62ceff956 00c71846874fea4917961236e49287a1850dcf98 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 360da60d6c6edb9740de7a8e6d8969d62ceff956 478c4d24193fe3e6aa2accd4874ae43000e4a217 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 360da60d6c6edb9740de7a8e6d8969d62ceff956 da406b8b49c1dfe661a497483940d7ee781430db git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 360da60d6c6edb9740de7a8e6d8969d62ceff956 441baa79043431807115fd030d7d0bb14ed441a0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.114 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72495","cve":"CVE-2026-72495","epss":"0.001940000","percentile":"0.084440000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72495","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T18:51:00.430753Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T18:55:26.977Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c","drivers/infiniband/hw/bnxt_re/ib_verbs.h","drivers/infiniband/hw/bnxt_re/uapi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b","status":"affected","version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","versionType":"git"},{"lessThan":"00c71846874fea4917961236e49287a1850dcf98","status":"affected","version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","versionType":"git"},{"lessThan":"478c4d24193fe3e6aa2accd4874ae43000e4a217","status":"affected","version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","versionType":"git"},{"lessThan":"da406b8b49c1dfe661a497483940d7ee781430db","status":"affected","version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","versionType":"git"},{"lessThan":"441baa79043431807115fd030d7d0bb14ed441a0","status":"affected","version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c","drivers/infiniband/hw/bnxt_re/ib_verbs.h","drivers/infiniband/hw/bnxt_re/uapi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.114","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page."}],"metrics":[{"cvssV3_1":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in BNXT_RE_METHOD_ALLOC_PAGE, reached only via write/ioctl on /dev/infiniband/uverbs* after IB ucontext creation; remote RoCE packet handling and in-kernel RDMA target/server paths never invoke this WC DPI allocation routine.\nAC:L - An attacker can deterministically trigger the bug by issuing repeated or concurrent BNXT_RE_ALLOC_WC_PAGE calls from multiple threads on the same ucontext; they control both sides of the race and need no uncontrollable memory layout or victim-specific state.\nPR:N - Standard uverbs character devices are created mode 0666, so any local process can open the bnxt_re device, allocate a ucontext, and invoke BNXT_RE_METHOD_ALLOC_PAGE without CAP_SYS_ADMIN, init-namespace root, or other elevated capabilities.\nUI:N - No victim interaction is required; exploitation needs only the attacker (or a compromised local RDMA workload) repeatedly or concurrently calling ALLOC_PAGE on resources it already controls through normal RDMA verbs.\nS:C - On HPC/cloud hosts exposing bnxt_re to tenant containers or unprivileged RDMA workloads, corrupting shared per-device DPI bookkeeping or exhausting finite doorbell indices crosses the container/tenant boundary to impact the host/kernel security authority.\nC:H - Without serialization or duplicate checks, corrupt DPI index bookkeeping and premature slot reuse can alias WC doorbell BAR pages across contexts, exposing other users' doorbell state and providing resource-corruption primitives usable for information disclosure.\nI:H - Destroying one ALLOC_PAGE object can deallocate another object's live WC DPI slot while its BAR mmap remains active, letting a later allocation share the same doorbell page and enabling cross-context WC doorbell writes that corrupt other tenants' RDMA queue signaling.\nA:H - Each orphaned DPI entry permanently consumes a finite per-device doorbell index (exhaustible via repeated or concurrent ALLOC_PAGE), denying RDMA service cluster-wide; unsynchronized wcdpi updates can also destabilize kernel DPI teardown paths."}]}],"providerMetadata":{"dateUpdated":"2026-10-21T12:45:04.330Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b"},{"url":"https://git.kernel.org/stable/c/00c71846874fea4917961236e49287a1850dcf98"},{"url":"https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217"},{"url":"https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db"},{"url":"https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0"}],"title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72495","datePublished":"2026-08-15T05:57:28.920Z","dateReserved":"2026-08-09T03:40:39.937Z","dateUpdated":"2026-10-21T12:45:04.330Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:23","lastModifiedDate":"2026-10-21 13:19:39","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:51:00.430753Z","id":"CVE-2026-72495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72495","Ordinal":"1","Title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages","CVE":"CVE-2026-72495","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72495","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page.","Type":"Description","Title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages"}]}}}