CVE-2026-45852

RDMA/rxe: Fix double free in rxe_srq_from_init

State: Published
Severity: 7.8 High
Published: May 27, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix double free in rxe_srq_from_init

In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'.

The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free.

The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core]

Fix this by moving 'srq->rq.queue = q' after copy_to_user.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-1341 Multiple Releases of Same Resource or Handle
CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before b98ab5494dbd48652561aa0b9c32f10500220745Affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before d493e0bfc748a520c349d6c8791b262aa5ad2e4eAffected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 9abff51163aa1bc275ec356f74fe976291860a7fAffected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 26793db60925df1e88a29466813d586cbc190b8cAffected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before ce6f8e007682f378279d4cf83b240f12d52c723bAffected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 5c07aef09a121a4cd622a71eb0753a9e135c84a8Affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 26a9cfe12f4ffdeaa136f252478986fa5f397ddcAffected aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 0beefd0e15d962f497aad750b2d5e9c3570b66d1Affected 350703fae672d4d649c3562c199eab5ec9dc7c79Affected 4.19.86 to before 4.20Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before b98ab5494dbd48652561aa0b9c32f10500220745Affected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before d493e0bfc748a520c349d6c8791b262aa5ad2e4eAffected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 9abff51163aa1bc275ec356f74fe976291860a7fAffected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 26793db60925df1e88a29466813d586cbc190b8cAffected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before ce6f8e007682f378279d4cf83b240f12d52c723bAffected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 5c07aef09a121a4cd622a71eb0753a9e135c84a8Affected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 26a9cfe12f4ffdeaa136f252478986fa5f397ddcAffected
aae0484e15f062ad2c2502e68e15dfb8b8f84608 to before 0beefd0e15d962f497aad750b2d5e9c3570b66d1Affected
350703fae672d4d649c3562c199eab5ec9dc7c79Affected
4.19.86 to before 4.20Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.