CVE-2026-72500

HighCVSS 8.8

Published: 15/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

In the Linux kernel's RDMA bnxt_re driver, the toggle page for SRQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_srq().

Risk Assessment

Risk of write to freed memory (use-after-free) could lead to system crash or data integrity compromise.

Recommendation

Apply the Linux kernel update containing the fix for CVE-2026-72500.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write the toggle values to an already-freed page. Move free_page() after bnxt_qplib_destroy_srq().