CVE-2026-45852

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix double free in rxe_srq_from_init

In rxe_srq_from_init(), the queue pointer 'q' is assigned to

'srq->rq.queue' before copying the SRQ number to user space.

If copy_to_user() fails, the function calls rxe_queue_cleanup()

to free the queue, but leaves the now-invalid pointer in

'srq->rq.queue'.

The caller of rxe_srq_from_init() (rxe_create_srq) eventually

calls rxe_srq_cleanup() upon receiving the error, which triggers

a second rxe_queue_cleanup() on the same memory, leading to a

double free.

The call trace looks like this:

kmem_cache_free+0x.../0x...

rxe_queue_cleanup+0x1a/0x30 [rdma_rxe]

rxe_srq_cleanup+0x42/0x60 [rdma_rxe]

rxe_elem_release+0x31/0x70 [rdma_rxe]

rxe_create_srq+0x12b/0x1a0 [rdma_rxe]

ib_create_srq_user+0x9a/0x150 [ib_core]

Fix this by moving 'srq->rq.queue = q' after copy_to_user.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References