CVE-2026-72495 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, free the Doorbell page index mapped for the WC page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's RDMA bnxt_re driver, specifically addressing a concurrency issue related to work completion (WC) page allocation within user contexts. This represents a classic resource management flaw that could lead to system instability and potential denial of service conditions. The issue stems from the driver's inability to properly handle multiple requests for WC pages associated with the same user context, despite supporting only a single WC page per ucontext.
The technical flaw manifests when applications submit multiple requests for WC pages under the same ucontext, creating a race condition scenario where concurrent access attempts can result in undefined behavior. Without proper synchronization mechanisms, these repeated requests can cause memory allocation conflicts and resource management inconsistencies. The vulnerability specifically affects the bnxt_re driver's handling of user space memory mappings through the mmap interface, where the driver must manage doorbell page indices for WC pages.
This weakness creates operational impact by potentially allowing malicious applications to consume excessive system resources or trigger kernel memory corruption through improper resource allocation patterns. The failure to properly validate repeated requests within the same ucontext can lead to inconsistent state management and resource leaks. From an ATT&CK perspective, this vulnerability aligns with privilege escalation techniques involving kernel memory manipulation and could be exploited by adversaries seeking to gain elevated privileges or cause system instability.
The mitigation strategy implemented involves adding a locking mechanism to serialize access to WC page allocation operations, preventing concurrent modifications during the allocation process. Additionally, the driver now includes explicit validation checks that identify and reject repeated requests for WC pages within the same ucontext, returning appropriate error codes to prevent resource exhaustion. The solution also addresses cleanup procedures by ensuring that when mmap entry insertion fails for WC pages, the corresponding doorbell page index mappings are properly freed to prevent resource leaks.
This vulnerability demonstrates the importance of proper synchronization in kernel drivers and highlights how seemingly simple resource management issues can create significant security implications. The fix aligns with CWE classification 362, which covers race conditions in concurrent programming, and addresses the broader category of improper resource management that affects system stability and security. Organizations should ensure their RDMA implementations are updated to include this patch, particularly in environments where multiple applications might be accessing the same ucontext simultaneously. The solution maintains backward compatibility while strengthening the driver's resilience against concurrent access patterns that could previously lead to system instability or resource exhaustion conditions.