{"id":"CVE-2026-72495","state":"PUBLISHED","title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page.","publishedAt":"2026-08-15T05:57:28.920Z","updatedAt":"2026-10-21T12:45:04.330Z","severity":{"score":9.3,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"00c71846874fea4917961236e49287a1850dcf98","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"478c4d24193fe3e6aa2accd4874ae43000e4a217","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"da406b8b49c1dfe661a497483940d7ee781430db","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"441baa79043431807115fd030d7d0bb14ed441a0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c","drivers/infiniband/hw/bnxt_re/ib_verbs.h","drivers/infiniband/hw/bnxt_re/uapi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c","drivers/infiniband/hw/bnxt_re/ib_verbs.h","drivers/infiniband/hw/bnxt_re/uapi.c"]}],"references":["https://git.kernel.org/stable/c/8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b","https://git.kernel.org/stable/c/00c71846874fea4917961236e49287a1850dcf98","https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217","https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db","https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72495.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72495","state":"PUBLISHED","datePublished":"2026-08-15T05:57:28.920Z","dateUpdated":"2026-10-21T12:45:04.330Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.937Z"},"containers":{"cna":{"title":"RDMA/bnxt_re: Avoid repeated requests to allocate WC pages","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"00c71846874fea4917961236e49287a1850dcf98","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"478c4d24193fe3e6aa2accd4874ae43000e4a217","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"da406b8b49c1dfe661a497483940d7ee781430db","versionType":"git"},{"version":"360da60d6c6edb9740de7a8e6d8969d62ceff956","status":"affected","lessThan":"441baa79043431807115fd030d7d0bb14ed441a0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c","drivers/infiniband/hw/bnxt_re/ib_verbs.h","drivers/infiniband/hw/bnxt_re/uapi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c","drivers/infiniband/hw/bnxt_re/ib_verbs.h","drivers/infiniband/hw/bnxt_re/uapi.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b"},{"url":"https://git.kernel.org/stable/c/00c71846874fea4917961236e49287a1850dcf98"},{"url":"https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217"},{"url":"https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db"},{"url":"https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in BNXT_RE_METHOD_ALLOC_PAGE, reached only via write/ioctl on /dev/infiniband/uverbs* after IB ucontext creation; remote RoCE packet handling and in-kernel RDMA target/server paths never invoke this WC DPI allocation routine.\nAC:L - An attacker can deterministically trigger the bug by issuing repeated or concurrent BNXT_RE_ALLOC_WC_PAGE calls from multiple threads on the same ucontext; they control both sides of the race and need no uncontrollable memory layout or victim-specific state.\nPR:N - Standard uverbs character devices are created mode 0666, so any local process can open the bnxt_re device, allocate a ucontext, and invoke BNXT_RE_METHOD_ALLOC_PAGE without CAP_SYS_ADMIN, init-namespace root, or other elevated capabilities.\nUI:N - No victim interaction is required; exploitation needs only the attacker (or a compromised local RDMA workload) repeatedly or concurrently calling ALLOC_PAGE on resources it already controls through normal RDMA verbs.\nS:C - On HPC/cloud hosts exposing bnxt_re to tenant containers or unprivileged RDMA workloads, corrupting shared per-device DPI bookkeeping or exhausting finite doorbell indices crosses the container/tenant boundary to impact the host/kernel security authority.\nC:H - Without serialization or duplicate checks, corrupt DPI index bookkeeping and premature slot reuse can alias WC doorbell BAR pages across contexts, exposing other users' doorbell state and providing resource-corruption primitives usable for information disclosure.\nI:H - Destroying one ALLOC_PAGE object can deallocate another object's live WC DPI slot while its BAR mmap remains active, letting a later allocation share the same doorbell page and enabling cross-context WC doorbell writes that corrupt other tenants' RDMA queue signaling.\nA:H - Each orphaned DPI entry permanently consumes a finite per-device doorbell index (exhaustible via repeated or concurrent ALLOC_PAGE), denying RDMA service cluster-wide; unsynchronized wcdpi updates can also destabilize kernel DPI teardown paths."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:45:04.330Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72495","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:51:00.430753Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:26.977Z"}}]}}}