CVE-2026-74584

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: zero shared page before exposing to userspace

bnxt_re_alloc_ucontext() allocates uctx->shpg via

__get_free_page(GFP_KERNEL). The buddy allocator does not zero pages

without __GFP_ZERO, so the page contains stale kernel data from

whatever object most recently freed it.

The page is then mapped into userspace via vm_insert_page() under

BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes

4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside

bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed

to userspace unsanitised, leaking kernel memory contents.

Any user with access to /dev/infiniband/uverbsX on a host with a

bnxt_re device (typically rdma group membership) can read this data

via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.

Other shared pages in the same file already use get_zeroed_page()

correctly:

drivers/infiniband/hw/bnxt_re/ib_verbs.c

srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL);

cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL);

uctx->shpg is the only outlier. Bring it in line with the existing

convention by switching to get_zeroed_page().