CVE-2026-74584

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: zero shared page before exposing to userspace

bnxt_re_alloc_ucontext() allocates uctx->shpg via

__get_free_page(GFP_KERNEL). The buddy allocator does not zero pages

without __GFP_ZERO, so the page contains stale kernel data from

whatever object most recently freed it.

The page is then mapped into userspace via vm_insert_page() under

BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes

4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside

bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed

to userspace unsanitised, leaking kernel memory contents.

Any user with access to /dev/infiniband/uverbsX on a host with a

bnxt_re device (typically rdma group membership) can read this data

via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.

Other shared pages in the same file already use get_zeroed_page()

correctly:

drivers/infiniband/hw/bnxt_re/ib_verbs

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References