CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: zero shared page before exposing to userspace

bnxt_re_alloc_ucontext() allocates uctx->shpg via
__get_free_page(GFP_KERNEL). The buddy allocator does not zero pages
without __GFP_ZERO, so the page contains stale kernel data from
whatever object most recently freed it.

The page is then mapped into userspace via vm_insert_page() under
BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes
4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside
bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed
to userspace unsanitised, leaking kernel memory contents.

Any user with access to /dev/infiniband/uverbsX on a host with a
bnxt_re device (typically rdma group membership) can read this data
via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.

Other shared pages in the same file already use get_zeroed_page()
correctly:

  drivers/infiniband/hw/bnxt_re/ib_verbs.c
      srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL);
      cq->uctx_cq_page  = (void *)get_zeroed_page(GFP_KERNEL);

uctx->shpg is the only outlier. Bring it in line with the existing
convention by switching to get_zeroed_page().

The Linux kernel CVE team has assigned CVE-2026-74584 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 5.10.260 with commit 53c97e9882f4e747b4ac31b211317c2eba541af9
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 5.15.211 with commit 9896bdfd21d918e9f26a52bc6109cc77970ee0b1
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 6.1.177 with commit 9128c2411b83a64c0a69d2ff059c741bde25a9cc
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 6.6.144 with commit c19b360fa10c521c0b681875cdaa51545d45a491
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 6.12.95 with commit a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 6.18.37 with commit e2b143df29003d2704b51f62e9297006953dbacb
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 7.0.14 with commit c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a
	Issue introduced in 4.11 with commit 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 and fixed in 7.1 with commit f6b079629becfa977f9c51fe53ad2e6dcc55ef44

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74584
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/hw/bnxt_re/ib_verbs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/53c97e9882f4e747b4ac31b211317c2eba541af9
	https://git.kernel.org/stable/c/9896bdfd21d918e9f26a52bc6109cc77970ee0b1
	https://git.kernel.org/stable/c/9128c2411b83a64c0a69d2ff059c741bde25a9cc
	https://git.kernel.org/stable/c/c19b360fa10c521c0b681875cdaa51545d45a491
	https://git.kernel.org/stable/c/a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1
	https://git.kernel.org/stable/c/e2b143df29003d2704b51f62e9297006953dbacb
	https://git.kernel.org/stable/c/c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a
	https://git.kernel.org/stable/c/f6b079629becfa977f9c51fe53ad2e6dcc55ef44