Linux Kernel CVE-2026-72495

Exploitation requires (1) local access to the target system with the ability to open the RDMA uverbs interface (/dev/infiniband/uverbsX), (2) a Broadcom NetXtreme RoCE NIC with the bnxt_re driver loaded and an active user context, and (3) the ability to issue repeated or concurrent mmap requests for write-combining (WC) pages on the same ucontext to hit the unlocked allocation path and the failing mmap-insert error branch. Limiting factors: the attack is local only (AV:L), it is inapplicable on any host lacking Broadcom RoCE hardware or the bnxt_re module, it depends on RDMA device permissions being reachable by the attacker, and reliably winning the race benefits from concurrency, making exploitation non-trivial despite the AC:L in the published vector.

The signals conflict sharply and should be weighed carefully. The assigned CVSS of 9.3 with S:C/C:H/I:H/A:H is characteristic of the Linux kernel CNA's blanket scoring for any kernel memory-safety-adjacent bug and almost certainly overstates real-world impact for this specific defect, which is a driver-local locking/leak issue. Corroborating lower-risk indicators: attack vector is Local (AV:L), EPSS is only 0.21% (11th percentile), the issue is not in CISA KEV, and no public PoC is known. Crucially, the vulnerable code path only executes on systems that both have a Broadcom RoCE NIC bound to bnxt_re AND expose the RDMA uverbs device to the attacker. The PR:N in the vector is questionable because reaching the uverbs mmap path in practice requires access to /dev/infiniband devices, which is not typically available to fully unprivileged users. Net assessment: low-to-moderate priority - patch in normal maintenance cycles rather than emergency; the high CVSS should not by itself drive out-of-band action absent the required hardware and device exposure.

A local user with access to the RDMA uverbs device on a host equipped with a Broadcom RoCE NIC opens a user context and issues repeated or concurrent mmap requests for a write-combining page against the same ucontext, racing the unserialized allocation path. On the resulting error path the driver leaks the Doorbell page index mapping, producing resource exhaustion or inconsistent state that may be leveraged for limited information disclosure. No public exploit identified at time of analysis; exploitation requires local code execution and specific hardware.