CVE-2026-74584 Overview
CVE-2026-74584 is an information disclosure vulnerability in the Linux kernel's bnxt_re RDMA driver for Broadcom NetXtreme-E adapters. The bnxt_re_alloc_ucontext() function allocates a shared page using __get_free_page(GFP_KERNEL) without the __GFP_ZERO flag. The buddy allocator returns pages containing stale kernel data from the previously freed object. The driver then maps this uninitialized page into userspace via vm_insert_page() under BNXT_RE_MMAP_SH_PAGE, exposing 4092 bytes of kernel memory to any local user with access to /dev/infiniband/uverbsX.
Critical Impact
Local users with RDMA group membership can read arbitrary kernel heap contents by issuing a single mmap() call at page offset 0 after IB_USER_VERBS_CMD_GET_CONTEXT, potentially leaking secrets, pointers, or credentials.
Affected Products
- Linux kernel with the bnxt_re RDMA driver enabled
- Systems using Broadcom NetXtreme-E RoCE devices
- Hosts exposing /dev/infiniband/uverbsX to rdma group members
Discovery Timeline
- 2026-08-22 - CVE-2026-74584 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74584
Vulnerability Analysis
The defect lies in bnxt_re_alloc_ucontext() inside drivers/infiniband/hw/bnxt_re/ib_verbs.c. The function allocates uctx->shpg using __get_free_page(GFP_KERNEL), which returns a physical page directly from the buddy allocator. Without the __GFP_ZERO flag, the page retains whatever bytes were last written by the previous owner of that memory.
The driver later maps uctx->shpg into userspace through bnxt_re_mmap() when the process passes the BNXT_RE_MMAP_SH_PAGE offset. The kernel only writes 4 bytes at offset BNXT_RE_AVID_OFFT (0x10) during bnxt_re_create_ah(), containing a 32-bit AVID value. The remaining 4092 bytes carry unsanitized kernel memory contents into the process address space.
The issue is classified as Uninitialized Memory Use leading to Information Disclosure. Related shared pages in the same driver (srq->uctx_srq_page and cq->uctx_cq_page) already use get_zeroed_page(), making the shared context page the sole outlier.
Root Cause
The root cause is missing zero-initialization on kernel memory that crosses the user/kernel boundary. __get_free_page() does not clear memory; the driver assumed the page would be initialized by later writes but only ever populates 4 bytes of the 4096-byte page.
Attack Vector
An attacker requires local access and membership in the rdma group, or another mechanism granting read/write on /dev/infiniband/uverbsX. The attacker opens the uverbs device, issues IB_USER_VERBS_CMD_GET_CONTEXT, then calls mmap() with pgoff set to the BNXT_RE_MMAP_SH_PAGE value. Reading the mapped page yields kernel data recycled from the buddy allocator's free list. The attack does not corrupt state; it is a passive read primitive suitable for defeating KASLR or exfiltrating in-memory secrets.
No public proof-of-concept exploit is currently referenced for CVE-2026-74584. See the upstream fix commits for the code-level change.
Detection Methods for CVE-2026-74584
Indicators of Compromise
- Unexpected processes opening /dev/infiniband/uverbsX outside of known RDMA workloads such as MPI, NVMe-oF, or storage fabrics
- User accounts newly added to the rdma group without change-management justification
- mmap() calls against uverbs file descriptors from shells, scripting interpreters, or short-lived processes
Detection Strategies
- Audit openat() and mmap() syscalls targeting /dev/infiniband/uverbs* using auditd or eBPF-based telemetry
- Baseline legitimate RDMA consumers on each host and alert on deviations
- Correlate uverbs access with process lineage to identify non-RDMA workloads touching the device
Monitoring Recommendations
- Track membership changes to the rdma group via /etc/group file integrity monitoring
- Log kernel module load events for bnxt_re and validate kernel versions against patched builds
- Forward audit and process telemetry to a central data lake for retrospective hunting across the fleet
How to Mitigate CVE-2026-74584
Immediate Actions Required
- Inventory Linux hosts running Broadcom NetXtreme-E adapters with the bnxt_re driver loaded
- Apply the upstream kernel patch that replaces __get_free_page(GFP_KERNEL) with get_zeroed_page(GFP_KERNEL) for uctx->shpg
- Restrict rdma group membership to service accounts and users that require RDMA access
Patch Information
The fix switches the allocation of uctx->shpg to get_zeroed_page(GFP_KERNEL), aligning it with the driver's existing convention for srq->uctx_srq_page and cq->uctx_cq_page. The change is available in the stable trees referenced by the following commits: Linux Kernel Commit 53c97e9, Linux Kernel Commit 9128c24, Linux Kernel Commit 9896bdf, Linux Kernel Commit a3ed2da, Linux Kernel Commit c19b360, Linux Kernel Commit c75f8ce, Linux Kernel Commit e2b143d, and Linux Kernel Commit f6b0796.
Workarounds
- Unload the bnxt_re module on hosts that do not require RDMA services using modprobe -r bnxt_re
- Blacklist bnxt_re via /etc/modprobe.d/ on systems where RoCE is unused
- Tighten permissions on /dev/infiniband/uverbs* and remove non-essential accounts from the rdma group
- Enable kernel hardening options such as init_on_alloc=1 at boot to force zeroing of freshly allocated pages as a defense-in-depth measure
# Configuration example
# Prevent the vulnerable driver from loading on hosts that do not need RDMA
echo 'blacklist bnxt_re' | sudo tee /etc/modprobe.d/blacklist-bnxt_re.conf
sudo modprobe -r bnxt_re
# Defense-in-depth: force page zeroing at allocation time
# Add init_on_alloc=1 to the kernel command line via GRUB, then:
sudo update-grub
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
