CVE-2026-74584

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA bnxt re driver where the bnxt re alloc ucontext() function allocates uctx->shpg using get free page(GFP KERNEL). Because the buddy allocator does not zero pages without the GFP ZERO flag, the allocated page may contain stale kernel data. This page is subsequently mapped into userspace via vm insert page() within bnxt re mmap(). Since the driver only writes 4 bytes at offset BNXT RE AVID OFFT (0x10) during bnxt re create ah(), the remaining 4092 bytes are exposed unsanitized, leading to the leakage of kernel memory contents. A user with access to /dev/infiniband/uverbsX on a host with a bnxt re device can read this data using mmap() at pgoff 0 following an IB USER VERBS CMD GET CONTEXT command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.