CVE-2026-72500

HighCVSS 8.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write the toggle values to an already-freed page. Move free_page() after bnxt_qplib_destroy_srq().

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b, < 3b6ecad5b9b0f7230ed725aafaf8c4ed9327a9bf; >= 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b, < 104a7ff382a58a83cae018925e3574c784e8274c; >= 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b, < 0adcd67f3d6f84835be682da0153f57f5c2f8036; >= 181028a0d84cdcc7ac86d05cc49eaa416ce85c8b, < 131e2918b9b0529687e67e2e58047304027f095a
LinuxLinux6.12

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72501In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Initialize dpi variable to zero dpi is initialized only CVE-2026-725027.5In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) CVE-2026-725065.1VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination inCVE-2026-725079.0The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SCVE-2026-725089.9A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allowCVE-2026-72519.8Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFCVE-2026-725109.0The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.CVE-2026-72528.1The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arCVE-2026-725226.2libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates dCVE-2026-725248.8Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data theyCVE-2026-725269.9A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotaCVE-2026-725285.1"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL,