Linux Kernel EUVD-2026-59398

Exploitation requires: (1) a Broadcom NetXtreme-E/C network adapter with the bnxt_re kernel driver loaded and RDMA functionality enabled - systems without this specific hardware and driver are entirely unaffected regardless of kernel version; (2) local low-privilege access (confirmed by CVSS PR:L) to the system, allowing the attacker to invoke RDMA verbs and trigger CQ lifecycle operations; (3) successful timing of an NQ interrupt arrival within the narrow race window between free_page() and completion of bnxt_qplib_destroy_cq() - this window is hardware-interrupt-driven and not directly controllable by the attacker, requiring repeated teardown cycles to probabilistically trigger. Limiting factors include: hardware specificity (only Broadcom NetXtreme-E/C RDMA adapters), RDMA must be actively configured and in use on the target system, and the race window is transient and hardware-dependent. Remote unauthenticated exploitation is not possible given the confirmed local attack vector (AV:L).

The reported CVSS 8.8 (High) with S:C/C:H/I:H/A:H reflects worst-case kernel memory corruption potential, theoretically enabling privilege escalation or kernel panic. However, real-world risk is substantially tempered by several converging signals: EPSS is 0.15% (5th percentile), indicating minimal observed exploitation activity. The vulnerability is not in CISA KEV and no POC is publicly available. Exploitation requires both a Broadcom NetXtreme-E/C RDMA-capable adapter and an active RDMA workload performing CQ teardown, substantially narrowing the exposed population. The race window is narrow - an NQ interrupt must arrive in the specific interval between free_page() and bnxt_qplib_destroy_cq() completion - which may warrant AC:H rather than the reported AC:L; the AC:L assessment appears optimistic for a hardware-interrupt-timing race condition. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H vector; full compromise impact is inferred from CVSS rather than independently confirmed through a vendor advisory detailing actual exploitation impact.

A local user with low privileges on a server equipped with a Broadcom NetXtreme-E/C adapter in RDMA mode repeatedly initiates and tears down Completion Queues via RDMA verbs to maximize the probability of an NQ interrupt arriving within the race window. By sustaining this high-frequency teardown pattern, the attacker eventually causes a hardware interrupt to write the toggle value to a freed kernel memory page, potentially corrupting adjacent kernel structures and enabling privilege escalation to root. No public proof-of-concept exists at time of analysis.