CVE-2026-72501 RDMA/bnxt_re: Initialize dpi variable to zero
A local attacker can read uninitialized kernel memory via the bnxt_re RDMA driver due to an uninitialized variable, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72501?
CVE-2026-72501 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Initialize dpi variable to zero
dpi is initialized only for BNXT_RE_ALLOC_WC_PAGE, but copied for all the cases. So initialize the dpi to 0.
Which versions are affected by CVE-2026-72501?
How do I fix CVE-2026-72501?
Apply the vendor's patch.
Is CVE-2026-72501 being exploited?
There is no known exploitation of CVE-2026-72501 in the wild and no public exploit code.
Sources
Also known as AZL-96009, BELL-CVE-2026-72501, DEBIAN-CVE-2026-72501, GHSA-whrr-9ch2-52gr, UBUNTU-CVE-2026-72501.