Database/Firmware, BMC & network fabric
Linux bnxt_re RoCE driver (CQ toggle page use-after-free): The completion-queue variant of the toggle-page
Impact
The completion-queue variant of the toggle-page use-after-free in the Broadcom RoCE driver. Same reachability — the RDMA object lifecycle, which tenants exercise every time they set up or tear down a connection — and the same concern that a stray firmware interrupt writes into memory the kernel has already handed back.
Who can reach it
Local user with RDMA verbs access, racing completion-queue destruction against a notification-queue interrupt.
What to do
Kernel/driver upgrade plus host reboot. Same rolling-drain cost as its SRQ sibling; both land in the same patch, so plan one reboot, not two.
References
Related entries
- Linux bnxt_re RoCE driver (SRQ toggle page use-after-free): A use-after-free in the Broadcom RoCE driver — the toggleCVE-2026-72500 · Linux bnxt_re RoCE driver (SRQ toggle page use-after-free)High
- U-Boot: malicious NFS server overflows the boot-time NFS read bufferCVE-2026-74220 · U-Boot net/nfs-common.c (nfs_read_reply length validation)High
- U-Boot: crafted NFS READLINK reply corrupts memory in the bootloaderCVE-2026-74221 · U-Boot net/nfs-common.c (nfs_readlink_reply symlink length)High
- IBM OpenBMC: ReadOnly BMC account can grant itself administrator privilegesCVE-2026-7868 · IBM OpenBMC (Power S1122/S1124 service processor firmware, ReadOnly role)High
- InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsNCVD-2021-006-infiniband-subnet-management-sub · InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsHigh
- InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsNCVD-2021-012-infiniband-subnet-management-sub · InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.