Executive brief
The Linux kernel's RDMA bnxt_re driver fails to zero a shared page before exposing it to unprivileged userspace, leaking approximately 4 KB of uninitialized kernel memory per device context. Any user with access to RDMA device interfaces (typically members of the rdma group) can read sensitive kernel data via a simple memory mapping operation.
Technical details
The vulnerability is an information disclosure (CWE-908: uninitialized memory) in the bnxt_re RDMA driver's bnxt_re_alloc_ucontext() function. The code allocates a shared page using __get_free_page(GFP_KERNEL), which does not zero the allocated memory; this page is then mapped into userspace via vm_insert_page() and vm_mmap() with only 4 bytes written by the driver, leaving ~4092 bytes of stale kernel data accessible. Attack vector is local: any process with /dev/infiniband/uverbsX access can exploit this via a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT without requiring elevated privileges. The fix is a one-line change from __get_free_page() to get_zeroed_page() to match the pattern already correctly used elsewhere in the driver.
Affected products
- Linux Linux Kernel from 1ac5a4047975 (RDMA/bnxt_re: Add bnxt_re RoCE driver) through patched versions
Timeline
- 2026-08-22: disclosed: CVE-2026-74584 published
- 2026-07-04: patched: Fix committed upstream (commit f6b079629becfa977f9c51fe53ad2e6dcc55ef44) and backported to stable branches