Linux kernel bnxt_re: uninitialised shared page mapped to userspace leaks kernel memory

Impact

bnxt_re_alloc_ucontext() allocates the per-context shared page with __get_free_page() and no __GFP_ZERO, then maps it into userspace via vm_insert_page(). The driver writes only 4 bytes into it, so the remaining 4092 bytes are whatever kernel object last freed that page - handed straight to the process that opened the verbs device. On a node where tenants get direct RDMA access for RoCE traffic, that is an unprivileged read of stale kernel heap contents, useful for leaking pointers and defeating KASLR before a second bug. The leak is per-context and repeatable, so an attacker can allocate contexts in a loop and sample many freed pages.

Who can reach it

Local user on a host with a Broadcom bnxt_re RDMA device who can open /dev/infiniband/uverbsX - typically rdma group membership, or any container given the verbs device node. No privileged capability needed beyond that device access: GET_CONTEXT followed by a single mmap() at pgoff 0.

What to do

Fix is a one-line switch to get_zeroed_page(), backported across five stable branches (see the git.kernel.org commits). Install the patched kernel and reboot the node; there is no runtime knob. Until then, the only mitigation is to stop exposing /dev/infiniband/uverbs* to untrusted tenants on bnxt_re hosts, which for RoCE-attached GPU nodes usually means losing user-space RDMA.

References

Related entries

• Linux kernel PMBus hwmon: type confusion in the alert path reads past the attribute allocationCVE-2026-74711 · Linux kernel hwmon pmbus core (pmbus_notify attribute type confusion)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored