CVE-2026-93277

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The attacker-controlled input is the UVERBS_ATTR_UHW_OUT pointer that ib_uverbs_ioctl's UVERBS_METHOD_INVOKE_WRITE copies into attrs->driver_udata; bnxt_re_dereg_mr, bnxt_re_dealloc_pd, bnxt_re_destroy_qp, bnxt_re_destroy_cq and bnxt_re_destroy_srq then clear_user that buffer via ib_respond_empty_udata after teardown. RoCE receive never supplies that udata.

AC:LAttack complexity, low

Mapping a PROT_READ/PROT_NONE page and passing it as UHW_OUT on INVOKE_WRITE IB_USER_VERBS_CMD_DEREG_MR (or DEALLOC_PD/DESTROY_QP/CQ/SRQ) makes ib_respond_empty_udata's clear_user fail after bnxt_re_dereg_mr kfree(mr); uverbs_destroy_uobject then keeps uobj->object and a second destroy or close() retries destroy_hw. No race or layout the attacker cannot arrange.

PR:LPrivileges required, low

uverbs_devnode() creates /dev/infiniband/uverbs* mode 0666 and ib_uverbs_open() only checks rdma_dev_access_netns(), so an unprivileged process can GET_CONTEXT, REG_MR, then INVOKE_WRITE DEREG_MR without CAP_SYS_ADMIN or init-namespace root.

UI:NUser interaction, none

The attacker opens their own uverbs fd, creates an MR/PD/QP/CQ/SRQ, then issues INVOKE_WRITE destroy with a non-writable UHW_OUT and a follow-up destroy or close(); no other user must mount, open, or click.

S:UScope, unchanged

The double-free is of the host kernel's bnxt_re_mr (kfree in bnxt_re_dereg_mr) and related driver objects (fence->mr, cq->cql, umem). It is local privilege escalation and does not cross a VM, IOMMU, or guest-to-host boundary.

C:HConfidentiality impact, high

bnxt_re_dereg_mr kfree(mr) then returns -EFAULT from ib_respond_empty_udata, so uobj->object still points at the freed bnxt_re_mr; the second destroy_hw walks that slab, and reclaiming it yields an arbitrary kernel read.

I:HIntegrity impact, high

The same preserved uobject lets the attacker spray the freed bnxt_re_mr (and fence->mr from bnxt_re_destroy_fence_mr on PD destroy, or cq->cql from bnxt_re_destroy_cq) and hijack the second destroy_hw/kfree, which is an arbitrary write and control-flow primitive.

A:HAvailability impact, high

Retrying destroy or closing the uverbs fd after the failed ib_respond_empty_udata double-frees mr/cql/umem and re-enters bnxt_qplib_destroy_qp/cq/srq on already-destroyed firmware objects, which oopses or panics the host.