Riskcovery

CVE-2026-72500

RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

State
Published
Severity
8.8 High
Published
Aug 15, 2026
Updated
Oct 21, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write the toggle values to an already-freed page. Move free_page() after bnxt_qplib_destroy_srq().

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b to before 3b6ecad5b9b0f7230ed725aafaf8c4ed9327a9bfAffected
  • 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b to before 104a7ff382a58a83cae018925e3574c784e8274cAffected
  • 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b to before 0adcd67f3d6f84835be682da0153f57f5c2f8036Affected
  • 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b to before 131e2918b9b0529687e67e2e58047304027f095aAffected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.