CVE-2026-45852RDMA/rxe: Fix double free in rxe_srq_from_init
- 7.8HighCVSS base score
- 0.20%Exploitation in 30 daysEPSS · top 90% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| redhat-SADPADP (enrichment) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < b98ab5494dbd48652561aa0b9c32f10500220745
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < d493e0bfc748a520c349d6c8791b262aa5ad2e4e
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < 9abff51163aa1bc275ec356f74fe976291860a7f
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < 26793db60925df1e88a29466813d586cbc190b8c
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < ce6f8e007682f378279d4cf83b240f12d52c723b
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < 5c07aef09a121a4cd622a71eb0753a9e135c84a8
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < 26a9cfe12f4ffdeaa136f252478986fa5f397ddc
- affected aae0484e15f062ad2c2502e68e15dfb8b8f84608 – < 0beefd0e15d962f497aad750b2d5e9c3570b66d1
- affected 350703fae672d4d649c3562c199eab5ec9dc7c79
- affected 4.19.86 – < 4.20
- affected 4.20
- unaffected < 4.20
- unaffected 5.10.259 – ≤ 5.10.*
- unaffected 5.15.210 – ≤ 5.15.*
- unaffected 6.1.176 – ≤ 6.1.*
- unaffected 6.6.128 – ≤ 6.6.*
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References21
- https://git.kernel.org/stable/c/b98ab5494dbd48652561aa0b9c32f10500220745 (opens in a new tab)
- https://git.kernel.org/stable/c/d493e0bfc748a520c349d6c8791b262aa5ad2e4e (opens in a new tab)
- https://git.kernel.org/stable/c/9abff51163aa1bc275ec356f74fe976291860a7f (opens in a new tab)
- https://git.kernel.org/stable/c/26793db60925df1e88a29466813d586cbc190b8c (opens in a new tab)
- https://git.kernel.org/stable/c/ce6f8e007682f378279d4cf83b240f12d52c723b (opens in a new tab)
- https://git.kernel.org/stable/c/5c07aef09a121a4cd622a71eb0753a9e135c84a8 (opens in a new tab)
- https://git.kernel.org/stable/c/26a9cfe12f4ffdeaa136f252478986fa5f397ddc (opens in a new tab)
- https://git.kernel.org/stable/c/0beefd0e15d962f497aad750b2d5e9c3570b66d1 (opens in a new tab)
- https://access.redhat.com/security/cve/CVE-2026-45852 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2482166 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45852.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:35844 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41236 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27713 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34094 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25217 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25121 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35896 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33899 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35863 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25120 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32318 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-45852)Record last updated .