Linux bnxt_re RoCE driver (SRQ toggle page use-after-free): TENANT ISOLATION: a use-after-free in the Broadcom RoCE

Impact

TENANT ISOLATION: a use-after-free in the Broadcom RoCE driver — the toggle page backing a shared receive queue is freed before firmware teardown completes, so a notification-queue interrupt arriving mid-destroy writes into freed memory. This is in the RDMA path, which means it is reachable from the queue-pair lifecycle that tenants drive directly when they open and close RDMA connections. A write-after-free driven by an interrupt in the RDMA control path is the shape of bug that turns into cross-tenant memory access on a shared RoCE fabric. Companion issue CVE-2026-72499 is the completion-queue equivalent.

Who can reach it

A local user with RDMA verbs access — i.e. any tenant running RoCE workloads — creating and destroying shared receive queues to race the teardown against an incoming NQ interrupt.

What to do

Kernel/driver upgrade plus host reboot. On a RoCE cluster this is a full rolling reboot of every node using Broadcom RDMA, and jobs must be drained first. If you cannot patch quickly, restricting which containers get RDMA device access (verbs char devices) narrows who can drive the vulnerable lifecycle — a config change in your container runtime.

References