High 8.8Published Aug 15, 2026

CVE-2026-72499RDMA/bnxt_re: Free CQ toggle page after firmware teardown

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e275919d96693c5ca964b20d73a33d52a7e57f04 before 33aed3ba04aa56eeeb876935896aa6530c46640e; from e275919d96693c5ca964b20d73a33d52a7e57f04 before b193854675ecad43b4d69c304c1b6a90b206cc99; from e275919d96693c5ca964b20d73a33d52a7e57f04 before bb45e06f9914ca64ac95341a80a0c20bb8dd46a9	CNA record

References

https://git.kernel.org/stable/c/33aed3ba04aa56eeeb876935896aa6530c46640e
https://git.kernel.org/stable/c/b193854675ecad43b4d69c304c1b6a90b206cc99
https://git.kernel.org/stable/c/bb45e06f9914ca64ac95341a80a0c20bb8dd46a9

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.