PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46053 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. The flaw occurs in `__rds_rdma_map()` when memory region (MR) mapping succeeds but subsequent copying of the generated cookie to user space fails. In this error path, the code incorrectly attempts to free scatter-gather (sg) pages that have already been transferred to transport ownership, leading to potential double-free or use-after-free conditions. The fix removes the duplicate unpin/free operations from the `put_user()` failure branch, ensuring MR teardown occurs only through the established final cleanup path.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux systems with RDS (Reliable Datagram Sockets) enabled, particularly those utilizing RDMA capabilities for high-performance networking workloads. Cloud providers, HPC environments, and financial services infrastructure using low-latency kernel networking features are most affected.

Technical summary

The vulnerability is located in `net/rds/rdma.c` in the `__rds_rdma_map()` function. After successful `get_mr()` execution, sg/page ownership transfers to the transport layer. If `put_user()` subsequently fails when copying the MR cookie to userspace, the original error path incorrectly invoked unpin/free operations on resources no longer owned by the caller. This creates a race condition where the transport may simultaneously access these resources while they are being freed, resulting in memory corruption. The correction removes this erroneous cleanup branch, relying solely on the MR reference drop to trigger proper teardown through the transport's established cleanup mechanisms.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing CVE-2026-46053
  • If running workloads using RDS RDMA, consider temporarily disabling RDS RDMA functionality if patching is not immediately feasible and the feature is not required
  • Review system logs for any RDS-related errors that may indicate exploitation attempts
  • Validate kernel version post-update to confirm patch application

Evidence notes

Vulnerability description confirms double-free/use-after-free pattern in RDS RDMA memory registration error handling. Kernel commit references indicate stable backports to multiple kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46053 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46053

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46053 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46053

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.