CVE-2026-72496 (GCVE-0-2026-72496)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-09-21 13:13
VLAI
Title
RDMA/bnxt_re: Proper rollback if the ioremap fails
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status.
Severity
9.2 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0ac20faf5d837b59fb4c041ea320932ed47fd67f , < 3c69ff7f4a761e18ce8abfa0c98e12097b39adaa (git)
Affected: 0ac20faf5d837b59fb4c041ea320932ed47fd67f , < f956477c343aa73e9d9c8d6ebf32efac7cd4f4e2 (git)
Affected: 0ac20faf5d837b59fb4c041ea320932ed47fd67f , < 303f6fef95df5e5316970746d861cf6daeeca77f (git)
Affected: 0ac20faf5d837b59fb4c041ea320932ed47fd67f , < 87267803a8c824616eb147c5dad7030a5db6f878 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/qplib_res.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c69ff7f4a761e18ce8abfa0c98e12097b39adaa",
              "status": "affected",
              "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
              "versionType": "git"
            },
            {
              "lessThan": "f956477c343aa73e9d9c8d6ebf32efac7cd4f4e2",
              "status": "affected",
              "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
              "versionType": "git"
            },
            {
              "lessThan": "303f6fef95df5e5316970746d861cf6daeeca77f",
              "status": "affected",
              "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
              "versionType": "git"
            },
            {
              "lessThan": "87267803a8c824616eb147c5dad7030a5db6f878",
              "status": "affected",
              "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/qplib_res.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Proper rollback if the ioremap fails\n\nbnxt_qplib_alloc_dpi returns success even if ioremap fails.\nAdd the proper rollback when the ioremap fails and return\n-ENOMEM status."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through local RDMA uverbs ioctl/write on /dev/infiniband/uverbs* (ibv_alloc_pd and BNXT_RE_ALLOC_WC_PAGE call bnxt_qplib_alloc_dpi); remote RoCE packet handling and in-kernel RDMA target/server paths never invoke this DPI setup routine.\nAC:L - An attacker can induce vmalloc/ioremap failure with local memory pressure, then repeatedly invoke alloc_pd or WC-page allocation; each call deterministically leaves a consumed DPI with NULL dbr, and subsequent create_cq/QP/SRQ doorbell rings fault without races or uncontrollable layout.\nPR:N - ib_uverbs creates per-device character nodes as mode 0666, so any local process can open uverbs, allocate a context, and call alloc_pd or alloc_page without CAP_SYS_ADMIN, init-namespace root, or other elevated capabilities on typical HPC/cloud RDMA hosts.\nUI:N - Exploitation requires only the attacker\u0027s own RDMA verbs sequence (alloc_context, alloc_pd or alloc_page, then create_cq/QP/SRQ and I/O); no cooperative action by another user, administrator, or victim mounting devices or opening files is needed.\nS:C - On Kubernetes/HPC hosts exposing bnxt_re to tenant containers or unprivileged RDMA workloads, triggering host-kernel NULL doorbell writes or exhausting finite DPI indices from a workload crosses the container/tenant security boundary to the hypervisor/host authority.\nC:L - Returning success after failed ioremap leaves DPI metadata and a mmapable BAR doorbell offset active while kernel dpi-\u003edbr stays NULL, disclosing doorbell-index/BAR layout to the caller and enabling follow-on corruption when doorbells are later rung.\nI:H - With dpi-\u003edbr left NULL, bnxt_qplib_ring_db and ring_prod_db issue writeq() to NULL during CQ, SQ, RQ, and SRQ doorbell updates on subsequent verbs activity, providing a kernel write primitive and control-flow disruption beyond a benign error return.\nA:H - NULL doorbell writeq faults oops or panic the kernel when CQ/QP/SRQ objects are used after the bogus allocation, and each successful-but-broken DPI allocation permanently consumes a finite doorbell index, enabling repeated denial of RDMA service to other tenants."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:13:57.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c69ff7f4a761e18ce8abfa0c98e12097b39adaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/f956477c343aa73e9d9c8d6ebf32efac7cd4f4e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/303f6fef95df5e5316970746d861cf6daeeca77f"
        },
        {
          "url": "https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"
        }
      ],
      "title": "RDMA/bnxt_re: Proper rollback if the ioremap fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72496",
    "datePublished": "2026-08-15T05:57:29.723Z",
    "dateReserved": "2026-08-09T03:40:39.937Z",
    "dateUpdated": "2026-09-21T13:13:57.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72496",
      "date": "2026-09-21",
      "epss": "0.00124",
      "percentile": "0.02492"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:03:13.000Z",
      "cve": "CVE-2026-72496",
      "id": "msrc_CVE-2026-72496",
      "initial_release_date": "2026-08-23T15:03:13.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/bnxt_re: Proper rollback if the ioremap fails",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72496.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/bnxt_re/qplib_res.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c69ff7f4a761e18ce8abfa0c98e12097b39adaa",
                    "status": "affected",
                    "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f956477c343aa73e9d9c8d6ebf32efac7cd4f4e2",
                    "status": "affected",
                    "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "303f6fef95df5e5316970746d861cf6daeeca77f",
                    "status": "affected",
                    "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "87267803a8c824616eb147c5dad7030a5db6f878",
                    "status": "affected",
                    "version": "0ac20faf5d837b59fb4c041ea320932ed47fd67f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/bnxt_re/qplib_res.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Proper rollback if the ioremap fails\n\nbnxt_qplib_alloc_dpi returns success even if ioremap fails.\nAdd the proper rollback when the ioremap fails and return\n-ENOMEM status."
          }
        ],
        "id": "CVE-2026-72496",
        "lastModified": "2026-09-21T14:17:18.053",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:23.940",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/303f6fef95df5e5316970746d861cf6daeeca77f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c69ff7f4a761e18ce8abfa0c98e12097b39adaa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f956477c343aa73e9d9c8d6ebf32efac7cd4f4e2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T10:42:54+00:00",
      "cve": "CVE-2026-72496",
      "id": "CVE-2026-72496",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/bnxt_re: Proper rollback if the ioremap fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72496.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:27:55Z",
      "cve": "CVE-2026-72496",
      "id": "CVE-2026-72496",
      "initial_release_date": "2026-08-27T00:23:07Z",
      "product_status:known_affected": "480",
      "product_status:known_not_affected": "239",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72496",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72496.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.