CVE-2026-74584 Linux CVE debrief

Who should care

Linux kernel maintainers, RDMA/bnxt_re component developers, and users with access to /dev/infiniband/uverbsX on a host with a bnxt_re device should assess exposure and apply patches or mitigations as needed.

Why it matters

The Linux kernel's RDMA/bnxt_re component does not properly initialize a shared page before exposing it to userspace, potentially leaking kernel memory contents. This issue requires immediate attention from Linux kernel maintainers and users with access to affected systems.

• Potential kernel memory disclosure to userspace.
• Elevation of privileges through unauthorized access to sensitive kernel data.
• Increased risk of targeted attacks exploiting this vulnerability.
• Possible data breaches due to exposure of unsanitized kernel memory contents.

Technical summary

The Linux kernel's RDMA/bnxt_re component does not properly initialize a shared page before exposing it to userspace. This issue arises from the allocation of uctx->shpg via __get_free_page(GFP_KERNEL) without the __GFP_ZERO flag. The affected page is then mapped into userspace through vm_insert_page() under BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). Although the driver writes 4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) within bnxt_re_create_ah(), the remaining 4092 bytes of the page are exposed unsanitized. This could lead to potential kernel memory disclosure to userspace, and users with access to /dev/infiniband/uverbsX on a host with a bnxt_re device can read this data via a single mmap() at pgoff

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches from the Linux kernel Git repository.
• Restrict access to /dev/infiniband/uverbsX to authorized users only.
• Monitor for potential exploitation attempts using kernel memory access patterns.
• Perform regular security audits to identify and address potential vulnerabilities.
• Implement additional logging and monitoring to detect suspicious activity.
• Review system configurations and ensure that all necessary security updates are applied.
• Conduct a thorough risk assessment to identify potential exposure and develop mitigation strategies.

Evidence notes

The CVE description and source item provide details on the vulnerability. Official references from the Linux kernel Git repository are available. The shared page is allocated using __get_free_page(GFP_KERNEL) without the __GFP_ZERO flag, leading to exposure of unsanitized kernel memory contents. To verify, defenders should review the Linux kernel Git repository for official patches and assess their systems for potential exposure. Evidence limits suggest that only specific kernel memory contents are exposed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.