The bnxt_re RDMA driver in the Linux kernel does not limit the number of write‑combining (WC) pages that can be requested for a single user context. When multiple requests are made concurrently, the driver lacks proper locking and performs no check to reject double requests. The fix adds a lock and a failure check, and ensures cleanup if a memory mapping fails. Because the driver previously allowed concurrent accesses, a sequence of repeated allocation requests could exhaust kernel resources or leave the driver in an inconsistent state, potentially resulting in a denial of service.

Any system running the Linux kernel with the bnxt_re RDMA driver before the kernel update that includes the lock and check. The specific kernel versions are not listed, so any install using an unpatched kernel is considered vulnerable.

EPSS is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. The flaw could be triggered by an RDMA client that repeatedly issues WC page allocation requests. Although the exact exploitation path is not documented, the absence of synchronization suggests that a repeated or concurrent request scenario could cause resource exhaustion or driver instability, hence the overall risk is considered moderate for environments that expose RDMA services. The CVSS score is 9.3, signaling a critical severity.