Skip to main content

Linux Kernel CVE-2026-72499

| EUVDEUVD-2026-59398 HIGH
2026-08-15 Linux GHSA-2899-vqg2-g66r
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

AC:H because reliable race-window timing between free_page() and hardware NQ interrupt delivery requires repeated attempts; PR:L for local RDMA device access; S:C as kernel driver corruption propagates to the full kernel execution environment.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 09:57 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Free CQ toggle page after firmware teardown

Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.

AnalysisAI

Use-after-free race condition in the Linux kernel's RDMA bnxt_re driver allows a local low-privileged user to corrupt kernel memory by triggering a Notification Queue (NQ) interrupt that writes to a freed CQ toggle page during Completion Queue teardown. Systems running Linux kernel versions prior to 7.1.5 or 7.2-rc1 with Broadcom NetXtreme-E/C RDMA-capable adapters are affected. No public exploit or active exploitation has been identified; EPSS remains at 0.15% (5th percentile), reflecting low real-world exploitation probability at time of analysis.

Technical ContextAI

The Broadcom NetXtreme-E/C RDMA kernel driver (bnxt_re) implements Completion Queues (CQ) used to signal completion of RDMA operations. A CQ toggle page is a kernel memory page used for doorbell toggle operations between the driver and hardware. During CQ destruction via bnxt_qplib_destroy_cq(), the original code freed the toggle page before completing firmware teardown - creating a time-of-free-to-use window where an incoming NQ (Notification Queue) hardware interrupt could attempt to write the toggle value to the now-freed page. This is a classic CWE-416 (Use After Free) race condition between asynchronous hardware interrupt delivery and kernel memory management. The S:C (Scope Change) in the CVSS vector reflects that kernel memory corruption within a driver context can affect the broader kernel execution environment beyond the isolated bnxt_re component. Affected CPE: cpe:2.3:a:linux:linux.

RemediationAI

The upstream fix is confirmed in two stable-branch commits: https://git.kernel.org/stable/c/bb45e06f9914ca64ac95341a80a0c20bb8dd46a9 and https://git.kernel.org/stable/c/b193854675ecad43b4d69c304c1b6a90b206cc99. The fix moves the free_page() call to after bnxt_qplib_destroy_cq() completes, eliminating the use-after-free window. Upgrade to Linux kernel 7.1.5 (stable) or 7.2-rc1 (development). For systems that cannot be patched immediately and do not require RDMA functionality, unloading or blacklisting the bnxt_re kernel module via 'modprobe -r bnxt_re' or adding 'blacklist bnxt_re' to /etc/modprobe.d/ eliminates the vulnerable code path entirely; the trade-off is loss of RDMA capability on Broadcom NetXtreme adapters, which may impact latency-sensitive workloads such as HPC or storage fabrics. Environments that require RDMA should treat patching as priority given no functionality-preserving workaround exists.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy