CVE-2026-72500

CVE-2026-72500

High · published August 15, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

Free the toggle page only after firmware teardown completes so that

an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write

the toggle values to an already-freed page. Move free_page() after

bnxt_qplib_destroy_srq().

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.6th percentile
Published
2026-08-15T10:22Z
References (4)
https://git.kernel.org/stable/c/0adcd67f3d6f84835be682da0153f57f5c2f8036 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/104a7ff382a58a83cae018925e3574c784e8274c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/131e2918b9b0529687e67e2e58047304027f095a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3b6ecad5b9b0f7230ed725aafaf8c4ed9327a9bf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 15 AUG 05:57Z
    RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
    cvelistv5