Linux bnxt_re RoCE driver (CQ toggle page use-after-free): The completion-queue variant of the toggle-page

Impact

The completion-queue variant of the toggle-page use-after-free in the Broadcom RoCE driver. Same reachability — the RDMA object lifecycle, which tenants exercise every time they set up or tear down a connection — and the same concern that a stray firmware interrupt writes into memory the kernel has already handed back.

Who can reach it

Local user with RDMA verbs access, racing completion-queue destruction against a notification-queue interrupt.

What to do

Kernel/driver upgrade plus host reboot. Same rolling-drain cost as its SRQ sibling; both land in the same patch, so plan one reboot, not two.

References