CVE-2026-72499

Received Received - Intake

RDMA/bnxt_re CQ Toggle Page Use-After-Free Fix

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72499

EUVD

EUVD-2026-59398

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the RDMA/bnxt_re driver. When freeing a completion queue (CQ) toggle page, the page is freed before the firmware teardown completes. This can lead to an NQ interrupt writing the toggle value to an already-freed memory page during the bnxt_qplib_destroy_cq() process.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/bnxt_re driver and involves a memory management issue during firmware teardown. Detection requires checking kernel logs for related errors or kernel crashes during RDMA operations. Commands like dmesg, journalctl -k, or checking for kernel oops messages may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could cause system instability or crashes due to memory corruption. It may lead to denial-of-service conditions or unexpected behavior in systems using the affected RDMA/bnxt_re driver.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a specific kernel memory management issue in the Linux RDMA subsystem. No evidence suggests data exposure or privacy implications that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-72499. This vulnerability affects the RDMA/bnxt_re driver and requires a kernel update to resolve the issue with freeing the CQ toggle page.

Hi! I’m here to help you understand CVE-2026-72499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70