{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72495", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.937Z", "datePublished": "2026-08-15T05:57:28.920Z", "dateUpdated": "2026-08-17T05:44:56.649Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:56.649Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is in BNXT_RE_METHOD_ALLOC_PAGE, reached only via write/ioctl on /dev/infiniband/uverbs* after IB ucontext creation; remote RoCE packet handling and in-kernel RDMA target/server paths never invoke this WC DPI allocation routine.\nAC:L - An attacker can deterministically trigger the bug by issuing repeated or concurrent BNXT_RE_ALLOC_WC_PAGE calls from multiple threads on the same ucontext; they control both sides of the race and need no uncontrollable memory layout or victim-specific state.\nPR:N - Standard uverbs character devices are created mode 0666, so any local process can open the bnxt_re device, allocate a ucontext, and invoke BNXT_RE_METHOD_ALLOC_PAGE without CAP_SYS_ADMIN, init-namespace root, or other elevated capabilities.\nUI:N - No victim interaction is required; exploitation needs only the attacker (or a compromised local RDMA workload) repeatedly or concurrently calling ALLOC_PAGE on resources it already controls through normal RDMA verbs.\nS:C - On HPC/cloud hosts exposing bnxt_re to tenant containers or unprivileged RDMA workloads, corrupting shared per-device DPI bookkeeping or exhausting finite doorbell indices crosses the container/tenant boundary to impact the host/kernel security authority.\nC:H - Without serialization or duplicate checks, corrupt DPI index bookkeeping and premature slot reuse can alias WC doorbell BAR pages across contexts, exposing other users' doorbell state and providing resource-corruption primitives usable for information disclosure.\nI:H - Destroying one ALLOC_PAGE object can deallocate another object's live WC DPI slot while its BAR mmap remains active, letting a later allocation share the same doorbell page and enabling cross-context WC doorbell writes that corrupt other tenants' RDMA queue signaling.\nA:H - Each orphaned DPI entry permanently consumes a finite per-device doorbell index (exhaustible via repeated or concurrent ALLOC_PAGE), denying RDMA service cluster-wide; unsynchronized wcdpi updates can also destabilize kernel DPI teardown paths."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/ib_verbs.h", "drivers/infiniband/hw/bnxt_re/uapi.c"], "versions": [{"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956", "lessThan": "478c4d24193fe3e6aa2accd4874ae43000e4a217", "status": "affected", "versionType": "git"}, {"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956", "lessThan": "da406b8b49c1dfe661a497483940d7ee781430db", "status": "affected", "versionType": "git"}, {"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956", "lessThan": "441baa79043431807115fd030d7d0bb14ed441a0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/ib_verbs.h", "drivers/infiniband/hw/bnxt_re/uapi.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217"}, {"url": "https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db"}, {"url": "https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0"}], "title": "RDMA/bnxt_re: Avoid repeated requests to allocate WC pages", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/ib_verbs.h", "drivers/infiniband/hw/bnxt_re/uapi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "478c4d24193fe3e6aa2accd4874ae43000e4a217", "status": "affected", "version": "360da60d6c6edb9740de7a8e6d8969d62ceff956", "versionType": "git"}, {"lessThan": "da406b8b49c1dfe661a497483940d7ee781430db", "status": "affected", "version": "360da60d6c6edb9740de7a8e6d8969d62ceff956", "versionType": "git"}, {"lessThan": "441baa79043431807115fd030d7d0bb14ed441a0", "status": "affected", "version": "360da60d6c6edb9740de7a8e6d8969d62ceff956", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/ib_verbs.h", "drivers/infiniband/hw/bnxt_re/uapi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page."}], "id": "CVE-2026-72495", "lastModified": "2026-08-17T06:19:17.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:23.840", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages", "id": "2516310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516310"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page.", "A flaw was found in the Linux kernel's RDMA/bnxt_re component. A local attacker could exploit this vulnerability by repeatedly requesting Work Completion (WC) pages for the same user context (ucontext), exceeding the supported limit of one page per context. This could lead to concurrent access issues and potentially result in a denial of service due to resource exhaustion."], "name": "CVE-2026-72495", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72495\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72495\nhttps://lore.kernel.org/linux-cve-announce/2026081539-CVE-2026-72495-d1ba@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[360da60d6c6edb9740de7a8e6d8969d62ceff956,478c4d24193fe3e6aa2accd4874ae43000e4a217)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[360da60d6c6edb9740de7a8e6d8969d62ceff956,da406b8b49c1dfe661a497483940d7ee781430db)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[360da60d6c6edb9740de7a8e6d8969d62ceff956,441baa79043431807115fd030d7d0bb14ed441a0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:00:11.224935+00:00", "updated": "2026-08-22T04:00:12.156837+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}