PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46189 Linux CVE debrief

A double-free vulnerability exists in the VMware paravirtual RDMA (vmw_pvrdma) driver within the Linux kernel. The flaw occurs in the error handling path of pvrdma_alloc_ucontext(), where pvrdma_uar_free() is called before pvrdma_dealloc_ucontext(). Since pvrdma_dealloc_ucontext() internally invokes pvrdma_uar_free(), this sequence results in the same memory being freed twice. Double-free conditions can lead to memory corruption, use-after-free scenarios, or kernel crashes. The vulnerability affects systems utilizing the vmw_pvrdma driver for RDMA functionality in VMware virtualized environments. The issue was resolved by removing the redundant pvrdma_uar_free() call in the error path.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux workloads on VMware infrastructure with RDMA-enabled virtual machines, particularly those using paravirtual RDMA devices. System administrators managing kernel security updates and virtualization platforms should prioritize this fix.

Technical summary

The vmw_pvrdma driver in the Linux kernel contains a double-free vulnerability in its user context allocation error handling. When pvrdma_alloc_ucontext() fails, it calls pvrdma_uar_free() before calling pvrdma_dealloc_ucontext(). However, pvrdma_dealloc_ucontext() also calls pvrdma_uar_free(), resulting in the same User Access Region (UAR) being freed twice. This memory management error can corrupt kernel heap metadata and potentially lead to privilege escalation or denial of service. The fix removes the extraneous pvrdma_uar_free() call from the error path in pvrdma_alloc_ucontext().

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2026-46189 when available from your Linux distribution
  • Verify that systems running VMware virtual machines with RDMA passthrough are using patched kernel versions
  • Monitor kernel logs for vmw_pvrdma-related errors or crashes that may indicate exploitation attempts
  • Review and update vulnerability management processes to track kernel-level RDMA driver security updates

Evidence notes

The CVE description explicitly identifies the double-free condition in pvrdma_alloc_ucontext() where pvrdma_uar_free() is called before pvrdma_dealloc_ucontext(), which itself calls pvrdma_uar_free(). Multiple kernel.org stable tree commits are referenced, indicating backports to affected kernel versions.

Official resources

2026-05-28