CVE-2026-72499 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the Linux kernel's RDMA subsystem, specifically in the bnxt_re driver that handles Bright Computing's BNXT (Broadcom NetXtreme) network adapters. The issue manifests as a race condition during the cleanup process of completion queues where improper sequencing of memory deallocation and firmware teardown operations creates a potential for memory corruption. The vulnerability stems from the incorrect order of operations during the destruction of completion queue resources, where the toggle page is freed before the firmware teardown process completes. This timing issue allows for interrupt handling to occur while the system is in an inconsistent state, potentially leading to writes to memory that has already been deallocated.
The technical flaw involves a classic race condition pattern where the kernel's RDMA driver fails to properly sequence its cleanup operations. During bnxt_qplib_destroy_cq() execution, the driver attempts to free a toggle page before completing the firmware teardown process that manages interrupt handling for the completion queue. This creates a window where NQ (NetXtreme Queue) interrupts can arrive and attempt to write data to the toggle page, which has already been freed by the kernel's memory management subsystem. The vulnerability directly relates to CWE-362, which describes race conditions in concurrent programming environments, and specifically maps to CWE-415, which addresses double free errors that can occur when memory is freed twice or when operations attempt to access freed memory.
The operational impact of this vulnerability extends beyond simple memory corruption scenarios to potentially compromise system stability and security. When an NQ interrupt arrives during the cleanup phase, it can cause the system to write invalid data to freed memory locations, leading to unpredictable behavior that may include system crashes, data corruption, or in extreme cases, privilege escalation opportunities. The vulnerability affects systems using BNXT network adapters with RDMA capabilities, particularly those running Linux kernels with affected versions of the bnxt_re driver. Attackers could potentially exploit this timing window to cause denial of service conditions or manipulate memory contents, though direct exploitation for privilege escalation would require additional attack vectors.
Mitigation strategies focus on correcting the operational sequence within the kernel driver code to ensure proper resource management during cleanup operations. The recommended fix involves reordering the cleanup process to execute bnxt_qplib_destroy_cq() first, allowing firmware teardown to complete fully before any memory deallocation occurs. This change ensures that interrupt handlers cannot access freed memory pages and prevents the race condition from occurring. System administrators should prioritize updating to kernel versions that include this patch, particularly those incorporating fixes for the bnxt_re driver's completion queue management. The solution aligns with ATT&CK technique T1068 by addressing privilege escalation pathways through proper resource management, and follows security best practices outlined in the Linux kernel security documentation. Organizations should also implement monitoring for unusual interrupt patterns or system instability that might indicate exploitation attempts against this vulnerability.