Linux kernel (drivers/infiniband/hw/bnxt_re): The variable-WQE send-queue slot count came straight from userspace with

CVSS 8.8CVE-2026-72497Firmware, BMC & network fabriccurated

Impact

The variable-WQE send-queue slot count came straight from userspace with no upper or lower bound, so a tenant could program a queue geometry the hardware cannot represent (above the 64K maximum, or zero). The CNA scored it scope-changed with full confidentiality, integrity and availability loss - the resulting adapter state escapes the requesting container's own boundary.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on a Broadcom bnxt_re NIC issues ibv_create_qp with a crafted slot count in variable-WQE mode. No fabric peer, no host root. Only bnxt_re nodes are affected.

What to do

No fixed version is listed in the record - take the stable kernel carrying a59d815cbe66 (or dc95931b7e13) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on bnxt_re nodes, or blacklist bnxt_re where RoCE is not needed.

References

https://git.kernel.org/stable/c/a59d815cbe667929b693b5fa6716a074e6a31c5b https://git.kernel.org/stable/c/dc95931b7e1326dacae547874bf38c092e5960d8 https://nvd.nist.gov/vuln/detail/CVE-2026-72497

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.