HIGH Introduced in 6.6
bnxt_re DBRPage Bypass
CVE-2026-92495
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
02KernelScan AI Analysis
Risk summary
A local user with access to a Broadcom NetXtreme RDMA device can bypass the driver's write protection on shared doorbell and pacing pages by upgrading a read-only mmap to writable via mprotect(). This allows unauthorized writes to device-shared memory, potentially corrupting device state and causing crashes or hangs. Systems exposing RDMA devices to untrusted or containerized workloads are at highest risk.
Vulnerability analysis
The driver shares doorbell and pacing pages with userspace but only checks for unwanted writable access when the initial memory mapping is created. Because the mapping is still internally flagged as allowed to become writable, a process can later upgrade it to write access using standard system calls to change memory permissions, bypassing the restriction entirely. The fix removes that upgrade permission before the page is inserted into the process address space, so the mapping stays read-only. Any local process that can open the Broadcom NetXtreme RDMA device can reach this flaw; whether ordinary users can trigger it depends on the device file permissions. Gaining write access allows corruption of device-shared state and can crash or hang the adapter.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.6 | 6.12.110 | 13e7861809ef |
| 6.18 | 6.6 | 6.18.52 | 0afbfe019c88 |
| 7.2 | 6.6 | 7.2.6 | 518df61b9b0a |
| mainline | 6.6 | 7.3-rc1 | 9b66c9af7172 |
| 6.6 | 6.6 | 6.6.157 | 5361fb1e5bc2 |
| cip/6.12 | 6.6 | 6.12.111-cip32 | 13e7861809ef |