CVE-2026-45891: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45891 Overview

CVE-2026-45891 is a double free vulnerability in the Linux kernel's HiSilicon Network Subsystem version 3 (hns3) Ethernet driver. The flaw resides in the hns3_set_ringparam() function, which creates a temporary copy (tmp_rings) of the ring structure for rollback purposes. The original ring handle's tx_spare pointer is left pointing to the old backup memory after the copy. If hns3_init_all_ring() fails during setup, the error cleanup path frees this stale pointer, causing a double free of the backup memory.

Critical Impact
A double free in kernel memory can corrupt allocator metadata and lead to kernel panics or memory corruption affecting system stability on hosts using HNS3 network adapters.

Affected Products

Linux kernel net/hns3 driver (HiSilicon HNS3 Ethernet driver)
Stable kernel branches receiving the referenced patch commits
Systems running HiSilicon Network Subsystem 3-capable network adapters

Discovery Timeline

2026-05-27 - CVE-2026-45891 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45891

Vulnerability Analysis

The vulnerability is a double free [CWE-415] in the hns3 network driver triggered during ring parameter reconfiguration. When a user adjusts ring parameters via ethtool, the driver invokes hns3_set_ringparam(). The function allocates a temporary tmp_rings structure to preserve the existing ring state for potential rollback. The tx_spare buffer pointer is copied into the temporary structure but remains intact in the original ring handle.

The driver then proceeds to allocate new resources through hns3_init_all_ring(). If memory allocation fails during this phase, the cleanup path iterates through all newly allocated rings and frees their associated buffers. Because the original ring still holds the stale tx_spare pointer that also exists in the backup, the same memory region is freed twice. This corrupts the kernel slab allocator state.

Root Cause

The root cause is incomplete pointer ownership transfer. After saving the tx_spare reference into tmp_rings, the driver never clears the field in the original ring structure. The dangling pointer is then treated as a live, newly allocated buffer by the error path. The upstream fix sets tx_spare to NULL in the original ring when creation of a replacement tx_spare fails, ensuring the cleanup path only frees genuinely new allocations.

Attack Vector

Triggering the flaw requires the ability to invoke ring parameter changes on an hns3 interface, typically through ethtool -G operations restricted to privileged users (CAP_NET_ADMIN). Exploitation also depends on inducing a memory allocation failure during hns3_init_all_ring(), which is more likely under memory pressure. The resulting kernel state corruption can cause denial of service through kernel panic, and in adversarial conditions may be leveraged toward further memory corruption primitives.

No public proof-of-concept exploit code is available for this issue. Refer to the upstream patch commits linked in the Linux stable tree for the exact source-level fix.

Detection Methods for CVE-2026-45891

Indicators of Compromise

Kernel oops or panic logs referencing hns3_set_ringparam, hns3_init_all_ring, or tx_spare free paths
Slab allocator corruption messages such as kernel BUG at mm/slub.c originating from HNS3 contexts
Unexpected ethtool reconfiguration failures followed by network interface instability on HiSilicon hardware

Detection Strategies

Inventory hosts running the HiSilicon HNS3 driver and correlate kernel versions against the patched stable releases referenced in the kernel.org commits
Enable KASAN (Kernel Address Sanitizer) and SLUB_DEBUG in test environments to surface the double free during regression testing
Monitor dmesg and /var/log/kern.log for double free or use-after-free signatures correlated to hns3 symbols

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized log analytics platform and alert on BUG:, double free, and Oops entries tied to hns3
Track ethtool ring parameter changes via auditd rules on setsockopt and netlink configuration calls
Watch for unexpected NIC resets, link flaps, or driver reload events on systems using HiSilicon network adapters

How to Mitigate CVE-2026-45891

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits fdbccddb7e78, 43015461662d, 6d2f142b1e4b, 6dc10494cfe2, c3659273860b, d2c785733dfb, and fb6a4c376d45 from the Linux stable tree
Update affected kernels to a stable release containing the net: hns3: fix double free issue for tx spare buffer fix
Restrict CAP_NET_ADMIN to required administrative accounts to limit who can trigger ring reconfiguration

Patch Information

The fix nulls the tx_spare pointer in the original ring structure after its value is transferred to tmp_rings, ensuring the error cleanup path in hns3_init_all_ring() does not free the backup memory a second time. Patches are available across multiple stable branches, including commits 43015461662d, 6d2f142b1e4b, 6dc10494cfe2, c3659273860b, d2c785733dfb, fb6a4c376d45, and fdbccddb7e78.

Workarounds

Avoid runtime ring parameter changes via ethtool -G on hns3 interfaces until the patched kernel is deployed
Reduce memory pressure on systems with HNS3 NICs to lower the likelihood of triggering the allocation failure that exposes the double free
Where feasible, limit administrative shell access to the host to reduce the population of users able to call into the affected code path

bash

# Verify running kernel version and HNS3 driver presence
uname -r
lsmod | grep hns3
ethtool -i <interface> | grep -E 'driver|version'

# Restrict ring parameter changes by removing CAP_NET_ADMIN from non-admin users
# and apply distribution kernel updates once available
sudo apt update && sudo apt upgrade linux-image-$(uname -r)