Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again, even though the driver resource has already been freed. Call ib_no_udata_io() before teardown so udata failures are detected while the resource is still intact, then return success after teardown completes. As part of this change, move ib_respond_empty_udata() to the start of the create and modify flows. While this is not strictly required for general create flows, as the core layer unwinds uobjects on failure, it is necessary for create AH. In _rdma_create_ah(), the HW object is otherwise leaked.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T16:17:24.907Z",
  "pubdate": "2026-09-24T16:17:24.907Z",
  "executiveSummary": "The vulnerability resides in the RDMA/bnxt_re driver within the Linux kernel, specifically concerning the mishandling of userspace data (udata) during resource destruction. The flaw involves a race condition or logic error where driver resources are torn down before validating the integrity of udata access.\nThe vulnerability manifests as an improper state management issue where the destroy callback zeros out udata output post-resource teardown. If userspace access fails during this process, the kernel uverbs layer preserves the uobject, allowing subsequent, redundant invocations of the destroy callback on already freed resources.\nThis creates a use-after-free or double-free condition, which can be exploited by an attacker with local access to the RDMA subsystem to trigger kernel memory corruption. Successful exploitation could lead to privilege escalation, arbitrary code execution, or system instability/denial-of-service. The impact is significant as it affects the core memory management of the bnxt_re RDMA driver, necessitating immediate patching.",
  "technicalDetails": "The root cause of this vulnerability is the premature execution of cleanup logic within the destroy callbacks of the bnxt_re driver without ensuring that userspace data (udata) can be safely accessed. In the original implementation, the driver would tear down hardware resources and subsequently attempt to zero the udata output. If the copy_to_user operation associated with the udata failed, the uverbs subsystem would erroneously keep the uobject alive.\nBecause the uobject persists, the kernel allows the destroy callback to be executed again. However, since the primary hardware resources were already freed in the first pass, this second invocation triggers a use-after-free scenario. This pattern allows an attacker to manipulate the state of the kernel's object tracking, potentially leading to the corruption of adjacent kernel memory structures.\nThe remediation involves shifting the validation logic by invoking ib_no_udata_io() before any resource teardown occurs. By validating the udata status early, the kernel ensures that if the userspace access fails, the operation aborts before the underlying hardware objects are destroyed, thus maintaining the integrity of the uobject state.\nFurthermore, the fix mandates moving ib_respond_empty_udata() to the initiation phase of create and modify flows. This is critical for objects like Address Handles (AH) in _rdma_create_ah(), where failure to validate early results in a permanent hardware resource leak. The modified control flow ensures that the hardware state and the kernel's tracking mechanism remain synchronized regardless of transient userspace access errors.\nExploitation involves a local user triggering the RDMA create/destroy path in a loop, specifically targeting the failure conditions of user-space data copying. By inducing repeated failures during the destruction phase, an attacker forces the driver into an inconsistent state where a 'freed' resource is still considered 'active' by the kernel, providing a primitive for memory corruption attacks.\nThe vulnerability affects systems utilizing the Broadcom NetXtreme-E series RDMA driver. Exploitation typically requires standard user privileges on a system with RDMA hardware enabled, with no requirement for high-level network exposure, making this primarily an issue of local privilege escalation within the Linux kernel subsystem."
}