Linux bnxt_re RoCE driver (bnxt_re_copy_err_stats out-of-bounds write): Out-of-bounds write in the Broadcom RoCE

Impact

Out-of-bounds write in the Broadcom RoCE driver's error-statistics copy, introduced when three RoCE hardware counters were added past the end of the existing array. Reading RDMA counters is something monitoring agents do constantly on an AI cluster, so the vulnerable path runs on a schedule whether or not anyone attacks it.

Who can reach it

Triggered by reading RoCE hardware counters — reachable from any local process permitted to query RDMA statistics, including monitoring agents.

What to do

Kernel/driver upgrade plus host reboot. Interim: stop polling RoCE hardware counters on Broadcom adapters, which costs you fabric observability — usually a worse trade than patching.

References

Related entries

• Linux kernel InfiniBand user MAD interface (ib_umad, /dev/infiniband/umad*): A process with access to the user MADCVE-2026-23243 · Linux kernel InfiniBand user MAD interface (ib_umad, /dev/infiniband/umad*)High
• Dell iDRAC Service Module (iSM) for Windows and Linux: Improper access control in the host-side iDRAC Service ModuleCVE-2026-23856 · Dell iDRAC Service Module (iSM) for Windows and LinuxHigh
• Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region failsCVE-2026-43128 · Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path)High
• Linux bnxt_en driver (RSS context delete logic): RSS contexts are not always freed in firmware when the driver deletesCVE-2026-43260 · Linux bnxt_en driver (RSS context delete logic)High
• Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init): If the copy_to_user() that returns the SRQCVE-2026-45852 · Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init)High
• Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE retransmit and ack timers race against queue-pair destructionCVE-2026-45910 · Linux kernel (drivers/infiniband/sw/rxe)High