HIGH
rdma SRQ DoubleFree
CVE-2026-45852
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user.
02KernelScan AI Analysis
Risk summary
A double free vulnerability in the RDMA rxe subsystem allows privileged local users to cause kernel memory corruption. The bug occurs when SRQ initialization fails during copy_to_user, leading to the same queue memory being freed twice. This can result in kernel crashes or potential privilege escalation through heap manipulation.
Vulnerability analysis
The vulnerability stems from improper error handling in rxe_srq_from_init() where the queue pointer is assigned to srq->rq.queue before copy_to_user() validation. When copy_to_user() fails, the function frees the queue but leaves a dangling pointer, causing the caller's cleanup path to free the same memory again. The fix reorders the assignment to occur after copy_to_user() succeeds, ensuring the pointer is only stored when the operation completes successfully. This requires local access with RDMA privileges and affects systems with InfiniBand or RXE (RDMA over Ethernet) configurations.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 4.20 | 4.20 | 22b8c23a3b92 |
| 5.10 | 5.10.252 | af5956243018 |
| 5.15 | 5.15.202 | d286f0d4e3ad |
| 6.1 | 6.1.165 | 26793db60925 |
| 6.12 | 6.12.75 | 5c07aef09a12 |
| 6.18 | 6.18.14 | 26a9cfe12f4f |
| 6.19 | 6.19.4 | 0beefd0e15d9 |
| 6.6 | 6.6.128 | ce6f8e007682 |
| mainline | 7.0 | — |