In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.
https://git.kernel.org/stable/c/bb45e06f9914ca64ac95341a80a0c20bb8dd46a9
https://git.kernel.org/stable/c/b193854675ecad43b4d69c304c1b6a90b206cc99