CVE-2026-74584: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74584 is a kernel memory disclosure vulnerability in the Linux kernel's RDMA/bnxt_re driver, classified as "Use of Uninitialized Resource" (CWE-908). The bnxt_re_alloc_ucontext() function allocates a shared page (uctx->shpg) using __get_free_page(GFP_KERNEL) without zeroing it, then maps it into userspace — exposing up to 4092 bytes of stale kernel memory. The vulnerability affects Linux kernel versions from 4.11 onward, with fixes backported to stable releases 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37, 7.0.14, and mainline 7.1. It was published on August 22, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-908 (Use of Uninitialized Resource): the Linux buddy allocator does not zero pages unless __GFP_ZERO is specified, so __get_free_page(GFP_KERNEL) returns a page containing stale kernel data from previously freed objects. The driver maps this page into userspace via vm_insert_page() under the BNXT_RE_MMAP_SH_PAGE mapping type in bnxt_re_mmap(). Only 4 bytes (a u32 AVID) are written at offset BNXT_RE_AVID_OFFT (0x10) during bnxt_re_create_ah(), leaving the remaining 4092 bytes of the 4096-byte page unsanitized and readable by any userspace process that calls mmap() at pgoff 0 after issuing IB_USER_VERBS_CMD_GET_CONTEXT. Other shared pages in the same driver (srq->uctx_srq_page, cq->uctx_cq_page) already correctly use get_zeroed_page(), making uctx->shpg the sole outlier (GitHub Advisory).

Successful exploitation allows a local user with access to /dev/infiniband/uverbsX (typically via rdma group membership) to read up to 4092 bytes of arbitrary stale kernel memory per context allocation, with no user interaction required. The leaked data may include sensitive kernel structures, pointers, cryptographic material, or other confidential information from recently freed kernel objects, potentially aiding in bypassing KASLR or facilitating further privilege escalation. Integrity and availability are not directly affected; the impact is limited to confidentiality (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires local access and membership in the rdma group, limiting the attack surface to systems with Broadcom bnxt_re RDMA devices where unprivileged users have been granted InfiniBand access. The EPSS score is 0.0022 (approximately 0.22%), indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Identify target: Confirm the target system has a Broadcom bnxt_re RDMA device and that the attacker has local access with rdma group membership (granting access to /dev/infiniband/uverbsX).
2. Open uverbs device: Open the InfiniBand userspace verbs device file, e.g., fd = open("/dev/infiniband/uverbs0", O_RDWR).
3. Issue GET_CONTEXT command: Send the IB_USER_VERBS_CMD_GET_CONTEXT ioctl to trigger bnxt_re_alloc_ucontext(), which allocates the uninitialized shared page (uctx->shpg) via __get_free_page(GFP_KERNEL).
4. Map the shared page: Call mmap() on the uverbs file descriptor with pgoff = 0 and the appropriate flags to trigger bnxt_re_mmap() with BNXT_RE_MMAP_SH_PAGE, mapping the uninitialized page into userspace.
5. Read leaked kernel memory: Read the mapped memory region (4096 bytes); bytes 0–15 and 20–4095 (excluding the 4-byte AVID at offset 0x10) contain stale kernel data from previously freed kernel objects, which can be parsed for sensitive information such as kernel pointers or cryptographic material (GitHub Advisory).

• Logs: Audit log entries (auditd) showing a local user in the rdma group opening /dev/infiniband/uverbs* followed immediately by an mmap syscall with pgoff=0 without a preceding IB_USER_VERBS_CMD_CREATE_AH operation.
• Process: Unexpected processes (not standard RDMA management tools) calling open() on /dev/infiniband/uverbsX and subsequently mmap() — particularly short-lived processes with no legitimate RDMA workload.
• File System: Presence of unusual scripts or binaries in user home directories that interact with /dev/infiniband/ devices on systems not running RDMA workloads.

Apply the available kernel patches that change bnxt_re_alloc_ucontext() to use get_zeroed_page(GFP_KERNEL) instead of __get_free_page(GFP_KERNEL). Fixed versions include Linux kernel stable releases 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37, 7.0.14, and mainline 7.1 (GitHub Advisory). As a workaround prior to patching, restrict membership in the rdma group to only trusted users who require RDMA access, thereby limiting exposure of /dev/infiniband/uverbsX devices (Red Hat).