CVE-2026-74584RDMA/bnxt_re: zero shared page before exposing to userspace
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GFP_ZERO, so the page contains stale kernel data from whatever object most recently freed it. The page is then mapped into userspace via vm_insert_page() under BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes 4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed to userspace unsanitised, leaking kernel memory contents. Any user with access to /dev/infiniband/uverbsX on a host with a bnxt_re device (typically rdma group membership) can read this data via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT. Other shared pages in the same file already use get_zeroed_page() correctly: drivers/infiniband/hw/bnxt_re/ib_verbs.c srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL); cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL); uctx->shpg is the only outlier. Bring it in line with the existing convention by switching to get_zeroed_page().
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before 53c97e9882f4e747b4ac31b211317c2eba541af9; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before 9896bdfd21d918e9f26a52bc6109cc77970ee0b1; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before 9128c2411b83a64c0a69d2ff059c741bde25a9cc; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before c19b360fa10c521c0b681875cdaa51545d45a491; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before e2b143df29003d2704b51f62e9297006953dbacb; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a; from 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 before f6b079629becfa977f9c51fe53ad2e6dcc55ef44 | CNA record |
References
- https://git.kernel.org/stable/c/53c97e9882f4e747b4ac31b211317c2eba541af9
- https://git.kernel.org/stable/c/9896bdfd21d918e9f26a52bc6109cc77970ee0b1
- https://git.kernel.org/stable/c/9128c2411b83a64c0a69d2ff059c741bde25a9cc
- https://git.kernel.org/stable/c/c19b360fa10c521c0b681875cdaa51545d45a491
- https://git.kernel.org/stable/c/a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1
- https://git.kernel.org/stable/c/e2b143df29003d2704b51f62e9297006953dbacb
- https://git.kernel.org/stable/c/c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a
- https://git.kernel.org/stable/c/f6b079629becfa977f9c51fe53ad2e6dcc55ef44
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.