CVE-2026-45852 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In…
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 7.0 | premières → < 7.0 | 7.0 |
| Linux 6.19 | premières → < 6.19.4 | 6.19.4 |
| Linux 6.18 | premières → < 6.18.14 | 6.18.14 |
| Linux 6.12 | premières → < 6.12.75 | 6.12.75 |
| Linux 6.6 | premières → < 6.6.128 | 6.6.128 |
| Linux 6.1 | premières → < 6.1.176 | 6.1.176 |
| Linux 5.15 | premières → < 5.15.210 | 5.15.210 |
| Linux 5.10 | premières → < 5.10.259 | 5.10.259 |
| Linux | 4.20 | Pas de correctif indiqué |
Afficher les 40 autres branches Masquer les 40 autres branches
Références
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
Chronologie
- Publiée
- Dernière modification