The vulnerability exists in the RDMA bnxt_re driver within the Linux kernel. During firmware teardown, the SRQ toggle page is freed prematurely; if an NQ interrupt occurs while bnxt_qplib_destroy_srq() is in progress, the driver may write to a memory page that has already been freed, resulting in a use‑after‑free that corrupts kernel memory.

All Linux kernel distributions that contain the unpatched bnxt_re code are potentially vulnerable, as the CVE does not list specific kernel versions. The flaw is present in any kernel image that includes the unmodified bnxt_re driver for RDMA devices.

Based on the description, the likely attack vector requires local access and the ability to trigger RDMA operations that invoke bnxt_qplib_destroy_srq(). Because the EPSS score is < 1% and the vulnerability is not listed in CISA KEV, the precise likelihood of exploitation is unknown, but the potential impact—remote code execution with kernel privileges—remains high. The CVSS score is 8.8. The flaw is a classic use‑after‑free and can lead to severe kernel corruption if exploited.