CVE-2026-45891

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix double free issue for tx spare buffer

In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure

is created for rollback. However, the tx_spare pointer in the original

ring handle is incorrectly left pointing to the old backup memory.

Later, if memory allocation fails in hns3_init_all_ring() during the setup,

the error path attempts to free all newly allocated rings. Since tx_spare

contains a stale (non-NULL) pointer from the backup, it is mistaken for

a newly allocated buffer and is erroneously freed, leading to a double-free

of the backup memory.

The root cause is that the tx_spare field was not cleared after its value

was saved in tmp_rings, leaving a dangling pointer.

Fix this by setting tx_spare to NULL in the original ring structure

when the creation of the new `tx_spare` fails. This ensures the

error cleanup path only frees genuinely newly allocated buffers.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References