CVE-2026-72495

CVE-2026-72495 is a race condition in the bnxt_re RDMA driver's WC (Work Completion) page allocation path, carrying a 9.3 CVSS. The vulnerability manifests in two ways that you should treat as distinct failure modes in your assessment. First, the concurrency bug: when multiple user-space contexts issue RDMA operations concurrently, the WC page allocation can be triggered simultaneously without adequate synchronization. The fix introduces a spinlock protecting the allocation path, but notably also adds a duplicate-request check — a runtime guard that suggests the original code assumed single-threaded access or considered concurrent access an edge case. The presence of both primitives indicates the developer may have encountered the race under load and patched the symptom rather than recognizing concurrency as the root cause. Second, the error path bug: when the mmap entry insertion fails, the allocated Doorbell page index must be freed. This cleanup step was missing entirely — a resource leak that would only trigger under a specific mmap failure condition, likely not exercised in standard test harnesses. This is the fingerprint of incomplete error handling where the happy path received attention but failure paths were not fully audited. For defenders, your priority should be: 1. Identify whether you have bnxt_re hardware and RDMA workloads in production. This is enterprise infrastructure — if you're running Mellanox or Broadcom RDMA adapters, check the driver version. 2. Recognize that the EPSS score of 0.00178 is misleading. This is a driver bug requiring RDMA hardware access to exploit, but exploitation doesn't require code execution — a misbehaving userspace process with RDMA permissions can trigger the race or the error path to cause resource leaks or corruption. The technical exploitability is narrow; the organizational blast radius for RDMA-dependent workloads is not. 3. The real exposure window is the remediation lag. The upstream fix exists in Linus's tree, but your LTS kernel — whether RHEL, SLES, or Canonical — will carry this vulnerability for months. This is not a technical distribution problem; it's organizational debt. Every day between upstream fix and LTS deployment is accumulated exposure that the eventual patch cannot erase. Your incident response planning should treat this window as known-but-accepted exposure and prioritize kernel refresh cycles for RDMA infrastructure. 4. This pattern recurs. Similar vulnerabilities appeared in CVE-2022-23222 and CVE-2021-47322 across the RDMA subsystem. Each generated a fix commit, but the pattern — missing synchronization around resource allocation combined with incomplete error path cleanup — persists because the knowledge circulates as patch artifacts, not as enforceable invariants. The next instance may appear in a driver that inherited the pattern through a stable kernel backport rather than writing it fresh, making root cause analysis even harder.

Reviewed through automated stages and approved by a human before publication.