UBUNTU-CVE-2026-74545: Double Free
In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtasestartxmit(), when the head buffer DMA mapping fails after rtasexmitfrags() has mapped all fragments, the error path clears the fragment descriptors with rtasetxclearrange(), which frees the skb through the last-frag slot and accounts txdropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again. Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In rtase_start_xmit(), return immediately after rtase_tx_clear_range() when the skb owns fragments, so the common error path does not free the multi-fragment skb or account tx_dropped a second time; retain the no-fragment path that frees the head skb once.
Event History
Frequently Asked Questions
What conditions are required to trigger the double free?
Transmission must use a multi-fragment skb, all fragment DMA mappings must succeed, and the head-buffer DMA mapping must then fail in rtase_start_xmit(). The no-fragment case is not described as taking the double-free path.
Which Ubuntu kernel package variants are identified as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What is the immediate effect when the vulnerable error path is reached?
The fragment cleanup frees the skb through the last-fragment descriptor, after which the common error path frees the same skb again. The transmit-drop accounting is also incremented twice.