PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45852 Linux CVE debrief

A double-free vulnerability exists in the Linux kernel's RDMA/rxe subsystem. In `rxe_srq_from_init()`, the queue pointer `q` is assigned to `srq->rq.queue` before `copy_to_user()` is invoked. If `copy_to_user()` fails, `rxe_queue_cleanup()` frees the queue, but the stale pointer remains in `srq->rq.queue`. When the caller `rxe_create_srq()` subsequently invokes `rxe_srq_cleanup()` upon error, a second `rxe_queue_cleanup()` occurs on the same memory, triggering a double-free condition. The fix relocates the assignment `srq->rq.queue = q` to occur only after successful `copy_to_user()` completion.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-08-20
Advisory published
2026-05-27
Advisory updated
2026-08-20

Who should care

Linux kernel maintainers, HPC/AI infrastructure operators utilizing RDMA over Converged Ethernet (RoCE), cloud providers offering RDMA-enabled instances, and security teams monitoring kernel memory integrity

Technical summary

The vulnerability resides in `drivers/infiniband/sw/rxe/rxe_srq.c` within the `rxe_srq_from_init()` function. The problematic code pattern assigns `srq->rq.queue = q` prior to the user-space copy operation. Upon `copy_to_user()` failure, the error path calls `rxe_queue_cleanup(q)`, freeing the queue memory. However, `srq->rq.queue` retains the now-dangling pointer. The calling function `rxe_create_srq()` detects the error and invokes `rxe_srq_cleanup()`, which internally calls `rxe_queue_cleanup(srq->rq.queue)`—the same memory region previously freed. This results in a use-after-free leading to double-free, corrupting the kernel's `kmem_cache` allocator state. The resolution ensures pointer assignment occurs only after confirmed successful user-space data transfer, eliminating the stale pointer condition.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches as referenced in official CVE sources
  • Prioritize patching systems utilizing RDMA/rxe (Soft-RoCE) functionality
  • Monitor kernel logs for kmem_cache_free or rxe_queue_cleanup anomalies indicating potential exploitation attempts
  • Validate kernel version against patched releases in stable trees

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry. Multiple kernel.org stable tree commits provided as references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45852 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45852

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45852 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45852

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0beefd0e15d962f497aad750b2d5e9c3570b66d1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/22b8c23a3b92d023614bb00896fe364b2c1a31d3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/26793db60925df1e88a29466813d586cbc190b8c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/26a9cfe12f4ffdeaa136f252478986fa5f397ddc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5c07aef09a121a4cd622a71eb0753a9e135c84a8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/af5956243018918130d52c9f671efdb40bab3366

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ce6f8e007682f378279d4cf83b240f12d52c723b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.