In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq() won't write the toggle value to an already-freed page. Move freepage() after bnxtqplibdestroy_cq.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72499.json"
}