During firmware teardown, the bnxt_re RDMA driver frees a page before ensuring that no NQ interrupts remain pending. An interrupt arriving during bnxt_qplib_destroy_cq() can then write to this already freed page, resulting in a classic use‑after‑free and kernel memory corruption. If successfully exploited, this could allow an attacker to execute arbitrary code in kernel mode, compromising system integrity and availability.

The affected product is the Linux kernel, specifically the bnxt_re RDMA driver that interacts with Intel BNX‑T network firmware. No specific kernel or driver version ranges are listed in the data, so all Linux kernel releases containing the unpatched bnxt_re module are potentially vulnerable.

The CVSS score is 8.8, indicating a high severity, and the EPSS score is <1%, suggesting low likelihood of exploitation. KEV indicates the vulnerability is not currently listed as known and actively exploited. Consequently, the exploitation likelihood is uncertain. Based on the description, it is inferred that the presence of a use‑after‑free in the kernel implies a high consequence if the flaw is triggered. The attack would likely utilize an NQ interrupt during driver teardown, which is an operation typically triggered by an administrator or during device removal. Based on the information, it is inferred that there is no publicly available exploit, so the immediate risk is limited to environments where firmware teardown can be controlled by a privileged user. Nonetheless, the potential for kernel privilege escalation makes the vulnerability critical in high‑risk contexts.