CVE-2026-74584

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/bnxt_re: zero shared page before exposing to userspace<br /> <br /> bnxt_re_alloc_ucontext() allocates uctx-&gt;shpg via<br /> __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages<br /> without __GFP_ZERO, so the page contains stale kernel data from<br /> whatever object most recently freed it.<br /> <br /> The page is then mapped into userspace via vm_insert_page() under<br /> BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes<br /> 4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside<br /> bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed<br /> to userspace unsanitised, leaking kernel memory contents.<br /> <br /> Any user with access to /dev/infiniband/uverbsX on a host with a<br /> bnxt_re device (typically rdma group membership) can read this data<br /> via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.<br /> <br /> Other shared pages in the same file already use get_zeroed_page()<br /> correctly:<br /> <br /> drivers/infiniband/hw/bnxt_re/ib_verbs.c<br /> srq-&gt;uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL);<br /> cq-&gt;uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL);<br /> <br /> uctx-&gt;shpg is the only outlier. Bring it in line with the existing<br /> convention by switching to get_zeroed_page().