CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix double free in rxesrqfrominit
In rxesrqfrominit(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copytouser() fails, the function calls rxequeuecleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'.
The caller of rxesrqfrominit() (rxecreatesrq) eventually calls rxesrqcleanup() upon receiving the error, which triggers a second rxequeuecleanup() on the same memory, leading to a double free.
The call trace looks like this: kmemcachefree+0x.../0x... rxequeuecleanup+0x1a/0x30 [rdmarxe] rxesrqcleanup+0x42/0x60 [rdmarxe] rxeelemrelease+0x31/0x70 [rdmarxe] rxecreatesrq+0x12b/0x1a0 [rdmarxe] ibcreatesrquser+0x9a/0x150 [ibcore]
Fix this by moving 'srq->rq.queue = q' after copytouser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the RDMA/rxe code path, fix the double-free by moving the queue pointer assignment `srq->rq.queue = q` to occur after `copy_to_user()` completes (instead of before it). If `copy_to_user()` fails, the function calls `rxe_queue_cleanup()`, so assigning the pointer only after successful copy prevents later cleanup from acting on an invalid/double-freed pointer.
Linux kernel RDMA/rxe (function rxe_srq_from_init / rxe_create_srq) srq->rq.queue assignment order relative to copy_to_user() = Move assignment so `srq->rq.queue = q` occurs after `copy_to_user()`
Event History
Frequently Asked Questions
What conditions are required to trigger the double free?
A local attacker needs privileges sufficient to create an SRQ through the RDMA RXE driver and must cause the copy_to_user() operation in rxe_srq_from_init() to fail. The failure path then frees the same queue twice.
Which systems are exposed?
Systems using the Linux kernel's rdma_rxe (RXE) driver are relevant. The provided information does not identify affected kernel versions or confirm whether the driver is enabled by default.
What is the impact of a successful trigger?
The double free can affect confidentiality, integrity, and availability, as reflected by the supplied high-severity vector. The issue occurs during user SRQ creation in the RXE RDMA path.
What code change resolves the issue?
The fix assigns srq->rq.queue only after copy_to_user() succeeds. This prevents the error cleanup path from retaining and later freeing an already released queue pointer.