During firmware teardown, the bnxt_re RDMA driver frees a page before ensuring that no NQ interrupts remain pending. An interrupt arriving during the bnxt_qplib_destroy_cq() routine can then write to this already freed page, resulting in a classic use‑after‑free and kernel memory corruption. If successfully exploited, this could allow an attacker to execute arbitrary code in kernel mode, compromise system integrity and availability.

The affected product is the Linux kernel, specifically the bnxt_re RDMA driver that interacts with Intel BNX‑T network firmware. No specific kernel or driver version ranges are listed in the data, so all Linux kernel releases containing the unpatched bnxt_re module are potentially vulnerable.

The CVSS and EPSS scores are not provided; KEV indicates the vulnerability is not currently listed as known and actively exploited. Consequently, the exploitation likelihood is uncertain, but the presence of a use‑after‑free in the kernel implies a high consequence if the flaw is triggered. The attack would likely utilize an NQ interrupt during driver teardown, which is an operation typically triggered by an administrator or during device removal. Without a publicly available exploit, the immediate risk is limited to environments where firmware teardown can be controlled by a privileged user. Nonetheless, the potential for kernel privilege escalation makes the vulnerability critical in high‑risk contexts.