Skip to main content

Linux Kernel CVE-2026-72495

| EUVDEUVD-2026-59394 CRITICAL
2026-08-15 Linux GHSA-3cmq-754m-66f5
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.3 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.3 CRITICAL
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
3.6 LOW

Local uverbs device access needed (PR:L, AV:L), winning the allocation race requires concurrency (AC:H); realistic impact is a limited leak and resource exhaustion (C:L/A:L, I:N, no scope change).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:54 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.3 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
CRITICAL 9.3
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Avoid repeated requests to allocate WC pages

Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to fail repeated requests. Also, if the mmap entry insert fails for the WC, free the Doorbell page index mapped for the WC page.

AnalysisAI

Improper resource handling in the Linux kernel's RDMA bnxt_re driver (Broadcom NetXtreme RoCE) allows a local user with access to the uverbs interface to trigger a race and an error-path resource leak by repeatedly requesting write-combining (WC) mmap pages for the same ucontext. The driver historically supported only one WC page per ucontext without a serializing lock, so concurrent or repeated requests could race and, on mmap-insert failure, leak the mapped Doorbell page index. The published CVSS is 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but this reflects the Linux CNA's conservative scoring convention; EPSS is 0.21% (11th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.

Technical ContextAI

The affected component is bnxt_re, the in-tree RDMA/InfiniBand verbs driver for Broadcom NetXtreme-E RoCE-capable NICs. When a userspace RDMA application creates a user context (ucontext) and mmaps device resources, it can request write-combining (WC) pages used for low-latency doorbell writes to the hardware. The driver only ever supports a single WC page per ucontext but, prior to this fix, lacked a lock to serialize allocation and lacked a guard to reject a second request, and it did not release the associated Doorbell page index if the mmap entry insertion failed. The root cause is a concurrency/resource-management defect (CWE-362 race condition combined with CWE-772 missing release of a resource on the error path); the upstream advisory lists no formal CWE (N/A). The tag 'Information Disclosure' suggests the practical consequence is limited leakage or state corruption rather than full memory compromise.

RemediationAI

Update to a Linux kernel that includes the fix: Vendor-released patch versions 6.18.40, 7.1.5, or 7.2-rc1, applied via the corresponding stable commits at https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db, https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217, and https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0. Distribution users should install the vendor kernel update that backports these commits. If patching must be deferred, effective compensating controls are to unbind or blacklist the bnxt_re module on hosts that do not need Broadcom RoCE RDMA (trade-off: disables RDMA offload for those NICs), and to restrict access to the RDMA uverbs character devices under /dev/infiniband to trusted users/groups only (trade-off: RDMA-using applications must run with that access). These controls close the local attack surface without kernel replacement.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72495 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy