CVE-2026-72499

HighCVSS 8.8

Published: 15/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

In the Linux kernel's RDMA bnxt_re driver, the toggle page for CQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_cq().

Risk Assessment

Risk of write to freed memory (use-after-free) could lead to system crash or data integrity compromise.

Recommendation

Apply the Linux kernel update containing the fix for CVE-2026-72499.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.