This vulnerability occurs in the Linux kernel’s bnxt_re RDMA driver when allocating a shared page for a user context. The page is obtained with __get_free_page without the __GFP_ZERO flag, leaving it populated with stale data from the last kernel object that freed the page. The driver then maps this page into userspace via vm_insert_page(), but only writes a 4‑byte AVID field, leaving the remaining 4092 bytes of the page exposed. Consequently, any user with access to /dev/infiniband/uverbsX can read kernel memory contents through a single mmap() call. The exploit achieves a confidentiality breach by leaking arbitrary kernel data to the attacker, but does not directly allow code execution or denial of service.

The flaw affects Linux kernel builds that include the bnxt_re RDMA driver. No specific kernel version is listed in the data, but the issue was addressed in commits referenced on the kernel git site (e.g., 53c97e9, 9128c24, etc.). Systems using a bnxt_re device that expose /dev/infiniband/uverbsX to rdma group users are impacted.

The CVSS score is not provided, and EPSS is unavailable, making the exact exploitation probability unclear. However, the weakness can be exercised by any user who already has rdma group membership and can perform the standard IB_USER_VERBS_CMD_GET_CONTEXT followed by a mmap() of the shared page. The vulnerability is not listed in CISA's KEV catalog, indicating no known public exploitation at this time. The flaw represents a serious information disclosure risk that should be mitigated as soon as a patched kernel is available.