Linux Kernel EUVD-2026-59399

Exploitation requires all of the following: (1) local shell access with at least low-privilege credentials (PR:L per CVSS - unauthenticated network exploitation is not possible); (2) a Broadcom NetXtreme-E network adapter physically present in the target system with the bnxt_re kernel module loaded and operational; (3) access to RDMA device nodes (typically /dev/infiniband/) to create and destroy SRQ objects - on default Linux configurations, this is restricted to users in the rdma or infiniband group or root; (4) the ability to win a race between SRQ teardown and NQ interrupt delivery, which is timing-dependent and non-trivial without additional primitives. Limiting factors include: no network attack vector (AV:L - physical or shell access required); requires specific Broadcom RDMA hardware absent from most commodity deployments; race window is narrow, raising practical exploitation difficulty above the AC:L vendor rating; RDMA device access is typically group-restricted in production Linux configurations.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) rates attack complexity as Low, which overstates accessibility for a race condition dependent on precise NQ interrupt timing relative to teardown sequencing - AC:H is a more defensible assessment. EPSS at 0.20% (10th percentile) reflects low real-world exploitation probability, consistent with the narrow hardware prerequisite of a Broadcom NetXtreme-E RDMA-capable NIC. There is no CISA KEV listing and no public proof-of-concept has been identified at time of analysis. The 'Information Disclosure' tag applied by intelligence sources materially understates actual risk: kernel use-after-free writes can yield full kernel-level compromise - privilege escalation and arbitrary code execution - consistent with the C:H/I:H/A:H impact ratings in the CVSS vector. This vulnerability is operationally significant for HPC, financial trading, and data center environments relying on Broadcom RDMA fabric; even a mid-sized municipal IT department in olsztyn operating bnxt_re-capable server hardware should prioritize this in the next scheduled patch cycle given the potential for kernel-level impact. The absence of active exploitation, low EPSS, and specialized hardware requirement collectively make this a patch-cycle priority rather than an emergency response item for most organizations.

A local user with low-privilege shell access on a server equipped with a Broadcom NetXtreme-E RDMA NIC opens the bnxt_re device and programmatically creates and destroys Shared Receive Queues in rapid succession. By timing SRQ destruction to coincide with an arriving NQ hardware interrupt - achievable through controlled system load or interrupt coaxing - the attacker causes the kernel to write toggle values into a page already returned to the allocator, potentially corrupting a subsequently allocated kernel object and opening a path to root privilege escalation or a kernel panic. No public proof-of-concept has been identified at time of analysis.