Linux Kernel EUVD-2026-86149

Requires a local user with access to the kernel RDMA/InfiniBand userspace-verbs interface (e.g., /dev/infiniband/uverbsN) on a system running the bnxt_re driver, i.e., a Broadcom NetXtreme-E adapter operating in RoCE/RDMA mode - this is not a default configuration on general-purpose hosts. Triggering requires forcing the uverbs udata copy to userspace to fail after resource teardown so the destroy callback re-runs against freed driver state; the create-AH variant additionally leaks the HW object. Limiting factors: PR:L (needs an existing local account with RDMA device permissions), AV:L (no remote/network reach), no user interaction, and hardware/driver dependency on Broadcom RDMA NICs.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a classic local privilege-escalation-class memory-safety flaw in the kernel: an authenticated local user with access to the RDMA userspace-verbs (uverbs) interface can trigger repeated execution of a destroy callback against already-freed driver resources - a use-after-free / double-free (the listed CWE is N/A, but the described 'run again after resource freed' behavior is CWE-416/CWE-415, not the 'Information Disclosure' the tag claims). No EPSS score, KEV entry, or public POC is present in the input, so exploitation is: no public exploit identified at time of analysis. Real-world priority is moderate and bounded: this is a genuine kernel memory-corruption bug (patched upstream via two git.kernel.org stable commits), but it is reachable only on systems that actually load the bnxt_re driver (Broadcom NetXtreme-E RoCE NICs) with RDMA userspace configured, and it requires a pre-existing local foothold (PR:L). There is no signal of active or automatable mass exploitation, so this is a patch-in-normal-cycle item for RDMA-enabled hosts rather than an emergency. Note the CVSS is local (AV:L) and consistent with the description; no network-vector conflict exists.

A local unprivileged (but RDMA-capable) user on a host with a Broadcom bnxt_re RoCE adapter issues a destroy verb (e.g., destroy AH/QP/CQ) and arranges for the userspace udata copy-out to fail after the driver has torn down the resource; uverbs preserves the uobject and re-invokes the destroy callback, operating on freed memory. Repeated triggering yields a use-after-free/double-free that can be groomed toward kernel memory corruption and privilege escalation. No public POC is referenced in the provided data.