PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45852 Linux CVE debrief

A double-free vulnerability exists in the Linux kernel's RDMA/rxe subsystem. In `rxe_srq_from_init()`, the queue pointer `q` is assigned to `srq->rq.queue` before `copy_to_user()` is invoked. If `copy_to_user()` fails, `rxe_queue_cleanup()` frees the queue, but the stale pointer remains in `srq->rq.queue`. When the caller `rxe_create_srq()` subsequently invokes `rxe_srq_cleanup()` upon error, a second `rxe_queue_cleanup()` occurs on the same memory, triggering a double-free condition. The fix relocates the assignment `srq->rq.queue = q` to occur only after successful `copy_to_user()` completion.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux kernel maintainers, HPC/AI infrastructure operators utilizing RDMA over Converged Ethernet (RoCE), cloud providers offering RDMA-enabled instances, and security teams monitoring kernel memory integrity

Technical summary

The vulnerability resides in `drivers/infiniband/sw/rxe/rxe_srq.c` within the `rxe_srq_from_init()` function. The problematic code pattern assigns `srq->rq.queue = q` prior to the user-space copy operation. Upon `copy_to_user()` failure, the error path calls `rxe_queue_cleanup(q)`, freeing the queue memory. However, `srq->rq.queue` retains the now-dangling pointer. The calling function `rxe_create_srq()` detects the error and invokes `rxe_srq_cleanup()`, which internally calls `rxe_queue_cleanup(srq->rq.queue)`—the same memory region previously freed. This results in a use-after-free leading to double-free, corrupting the kernel's `kmem_cache` allocator state. The resolution ensures pointer assignment occurs only after confirmed successful user-space data transfer, eliminating the stale pointer condition.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches as referenced in official CVE sources
  • Prioritize patching systems utilizing RDMA/rxe (Soft-RoCE) functionality
  • Monitor kernel logs for kmem_cache_free or rxe_queue_cleanup anomalies indicating potential exploitation attempts
  • Validate kernel version against patched releases in stable trees

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry. Multiple kernel.org stable tree commits provided as references.

Official resources

2026-05-27