Local privilege escalation via CQ toggle use-after-free

Use-after-free in the Linux kernel bnxt_re driver allows local users to escalate privileges by destroying an RDMA completion queue. The CQ destroy path frees its toggle page before bnxt_qplib_destroy_cq finishes, allowing an NQ interrupt to write a controlled value into a page returned to the allocator. Exploitation requires RDMA uverbs access and a Gen P7 bnxt_re device; the resulting kernel-memory corruption supports host crashes or privilege escalation.