Executive brief
The Linux kernel's RDMA Broadcom bnxt_re driver contains a privilege escalation flaw in its memory mapping handler. A user can bypass write-access restrictions on special memory pages (DBR and toggle pages) used for hardware communication by initially mapping them read-only, then upgrading permissions with mprotect(), allowing unauthorized memory writes.
Technical details
The vulnerability is a privilege escalation in the bnxt_re_mmap() function due to incomplete memory protection flag handling. The driver rejects VM_WRITE flags for DBR_PAGE and TOGGLE_PAGE mmap operations, but failed to clear VM_MAYWRITE, which allows a subsequent mprotect(PROT_WRITE) call to upgrade a read-only mapping to writable. An unprivileged local user with access to RDMA devices can exploit this to gain write access to kernel memory pages that should be read-only, potentially achieving privilege escalation or information disclosure. The fix clears the VM_MAYWRITE flag before vm_insert_page() to enforce the read-only policy. Patches were committed to the Linux stable kernel branches in September 2026.
Affected products
- Linux Linux kernel Multiple versions prior to fix (September 2026)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix committed to stable kernel branches