## Summary
CVE-2026-72500 fixes a Linux kernel RDMA driver issue in bnxt_re where an SRQ “toggle page” could be freed too early during SRQ destruction. If an NQ interrupt arrives while bnxt_qplib_destroy_srq() is still running, the interrupt may write toggle values to an already-freed page.
## Technical Details
- The bug is in bnxt_re_destroy_srq() in drivers/infiniband/hw/bnxt_re/ib_verbs.c.
- The patch changes the order of operations:
- Previously, when toggle_bits includes BNXT_QPLIB_SRQ_TOGGLE_BIT, the code called free_page((unsigned long)srq->uctx_srq_page) before bnxt_qplib_destroy_srq(&rdev->qplib_res, qplib_srq).
- The fix moves free_page() to occur after bnxt_qplib_destroy_srq() completes, and also keeps hash_del(&srq->hash_entry) in the pre-destroy portion.
- Rationale from the advisory text: an NQ interrupt arriving during bnxt_qplib_destroy_srq() must not write toggle values to an already-freed page.
- Relevant identifiers from the patch:
- bnxt_qplib_destroy_srq()
- BNXT_QPLIB_SRQ_TOGGLE_BIT
- srq->uctx_srq_page
- free_page()
## Affected
- Linux kernel bnxt_re RDMA driver code path: drivers/infiniband/hw/bnxt_re/ib_verbs.c (bnxt_re_destroy_srq()).
- The patch references a prior change: Fixes: 181028a0d84c ("RDMA/bnxt_re: Share a page to expose per SRQ info with userspace").
## Impact
- Potential memory corruption/use-after-free: an NQ interrupt may write to a freed SRQ toggle page.
- The CVSS vector indicates high impact on confidentiality/integrity/availability (per NVD metrics provided).
## Mitigation
1. Apply the upstream/stable kernel patch that moves free_page() to after bnxt_qplib_destroy_srq() in bnxt_re_destroy_srq().
2. Ensure systems using bnxt_re RDMA functionality are updated to a kernel version containing the fix commit(s) referenced in the stable trees (0adcd67f3d6f84835be682da0153f57f5c2f8036, 104a7ff382a58a83cae018925e3574c784e8274c, and upstream 131e2918b9b0529687e67e2e58047304027f095a).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H