CVE-2026-45852: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45852 Overview

CVE-2026-45852 is a double free vulnerability in the Linux kernel's RDMA/rxe (Remote Direct Memory Access over Ethernet) subsystem. The flaw resides in the rxe_srq_from_init() function, where the queue pointer q is assigned to srq->rq.queue before the SRQ number is copied to user space. When copy_to_user() fails, the function frees the queue via rxe_queue_cleanup() but leaves the stale pointer in srq->rq.queue. The caller rxe_create_srq() then invokes rxe_srq_cleanup() on the same memory, triggering a second free. The issue has been resolved across multiple stable kernel branches.

Critical Impact
A double free in kernel-managed RDMA memory can corrupt kernel heap state, potentially leading to local denial of service or memory corruption that may be leveraged for privilege escalation.

Affected Products

Linux kernel — RDMA/rxe driver (rdma_rxe module)
Distributions shipping affected stable kernel branches prior to the listed fix commits
Systems with the Soft-RoCE (rdma_rxe) module loaded and SRQ creation exposed to userspace

Discovery Timeline

2026-05-27 - CVE-2026-45852 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45852

Vulnerability Analysis

The vulnerability is a [Double Free] condition in the Soft-RoCE driver's Shared Receive Queue (SRQ) initialization path. The function rxe_srq_from_init() allocates a queue and immediately stores its pointer in srq->rq.queue. It then calls copy_to_user() to return the SRQ number to userspace. If that copy fails, the function correctly frees the queue with rxe_queue_cleanup(), but does not clear the pointer in the SRQ structure.

Control then returns to rxe_create_srq(), which observes the error and invokes the standard cleanup path rxe_srq_cleanup(). That cleanup path calls rxe_queue_cleanup() a second time on the already-freed memory. The result is a kernel-side double free of a slab object backing the receive queue.

Root Cause

The root cause is improper error-path ordering. The pointer assignment srq->rq.queue = q occurs before the failure-prone copy_to_user() call, creating a window where ownership of the freed object is ambiguous between the local error handler and the caller-level cleanup routine. The corrective patches move the assignment to occur only after copy_to_user() succeeds, ensuring that a failed copy frees the queue exactly once locally and never exposes the pointer to the caller's cleanup logic.

Attack Vector

Triggering the bug requires a local user able to invoke the ib_create_srq_user() path on an rdma_rxe device and induce a copy_to_user() failure, for example by supplying an invalid or unmapped user buffer for the SRQ response. The reported call trace is:

kmem_cache_free+0x.../0x...
rxe_queue_cleanup+0x1a/0x30 [rdma_rxe]
rxe_srq_cleanup+0x42/0x60 [rdma_rxe]
rxe_elem_release+0x31/0x70 [rdma_rxe]
rxe_create_srq+0x12b/0x1a0 [rdma_rxe]
ib_create_srq_user+0x9a/0x150 [ib_core]

Successful exploitation depends on local code execution and the presence of the rdma_rxe module. Remote exploitation is not described in the advisory.

Detection Methods for CVE-2026-45852

Indicators of Compromise

Kernel oops or panic messages referencing rxe_queue_cleanup, rxe_srq_cleanup, or rxe_elem_release in dmesg or journalctl -k output.
KASAN (Kernel Address Sanitizer) reports flagging a double-free on slab objects allocated by the rdma_rxe module.
Unexpected loading of the rdma_rxe module on hosts that do not require Soft-RoCE functionality.

Detection Strategies

Audit running kernel versions against the fixed commits (0beefd0e, 22b8c23a, 26793db6, 26a9cfe1, 5c07aef0, af595624, ce6f8e00, d286f0d4) using uname -r and distribution package metadata.
Monitor for processes invoking ib_uverbs ioctls that create SRQs on Soft-RoCE devices, particularly from non-privileged users.
Enable slub_debug or KASAN in test environments to surface double-free conditions originating from the rxe driver.

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on stack traces containing rxe_ symbols paired with kmem_cache_free or slab corruption strings.
Track loaded kernel modules across the fleet and flag systems where rdma_rxe is loaded outside of approved RDMA workloads.
Correlate kernel crash events with local user activity to identify potential exploitation attempts.

How to Mitigate CVE-2026-45852

Immediate Actions Required

Apply the upstream stable kernel update containing the fix as soon as your distribution publishes a patched build.
Unload the rdma_rxe module on systems that do not require Soft-RoCE: modprobe -r rdma_rxe.
Restrict access to RDMA uverbs device nodes (/dev/infiniband/uverbs*) using filesystem permissions and namespace isolation.

Patch Information

The fix moves srq->rq.queue = q to execute only after copy_to_user() succeeds, eliminating the stale pointer that caused the second rxe_queue_cleanup() call. The patch has been backported across multiple stable trees. Refer to the following kernel.org commits for the exact change and applicable branches:

Workarounds

Blacklist the rdma_rxe module on hosts that do not need Soft-RoCE to remove the vulnerable code path entirely.
Limit local user access on systems where the module must remain loaded, since exploitation requires local invocation of ib_create_srq_user().
Enable kernel hardening features such as KASAN or slub_debug=P in non-production systems to detect any residual double-free behavior during validation.

bash

# Configuration example: prevent rdma_rxe from loading
echo 'blacklist rdma_rxe' | sudo tee /etc/modprobe.d/disable-rdma-rxe.conf
sudo modprobe -r rdma_rxe 2>/dev/null || true
sudo update-initramfs -u