A race condition in the bnxt_re RDMA driver allows the destroy callback to be invoked twice after the driver resources have already been freed. The callback zeroes out user data after tear‑down, but if user‑space access fails, the underlying uobject stays alive and the callback runs again. This double free/use‑after‑free can be abused to execute arbitrary code in kernel mode, granting the attacker elevated privileges.

The vulnerability exists in the Linux kernel’s RDMA subsystem, specifically the bnxt_re driver. It affects all distributions that ship a kernel version before the patch that implements the ‘ib_no_udata_io’ change. Version information is not explicitly listed, so any unpatched kernel in use is potentially impacted.

The CVSS score of 7.8 indicates a high severity. The EPSS score is < 1%, and the vulnerability is not listed in KEV, suggesting no active exploitation reports yet. However, the nature of the flaw means a local user with the ability to interact with RDMA is at risk of privilege escalation. Exploitation would require a well‑crafted userspace application, so the likelihood is lower but still feasible if the kernel is not patched.