The Linux kernel bnxt_re driver allocates a shared page (uctx->shpg) using __get_free_page(GFP_KERNEL), which does not zero the memory, leaving stale kernel data from previously freed objects. This page is then mapped into userspace via vm_insert_page() with only 4 bytes explicitly overwritten, exposing the remaining 4092 bytes of kernel memory to userspace. Users with access to /dev/infiniband/uverbsX and membership in the rdma group can read this leaked data via mmap after issuing IB_USER_VERBS_CMD_GET_CONTEXT. The vulnerability is fixed by switching the allocation to get_zeroed_page(), ensuring the page is zeroed before exposure.

This vulnerability leaks kernel memory contents to unprivileged users with access to the RDMA bnxt_re device interface. The leaked data may include sensitive kernel information, potentially aiding further attacks or information disclosure. However, no direct code execution or privilege escalation is described.

A fix is available that changes the allocation of the shared page to use get_zeroed_page(), which zeroes the memory before mapping it to userspace. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel driver vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.