CVE-2026-46053: Linux Kernel RDS MR Cleanup Vulnerability

CVE-2026-46053 Overview

CVE-2026-46053 is a Linux kernel vulnerability in the Reliable Datagram Sockets (RDS) Remote Direct Memory Access (RDMA) subsystem. The flaw resides in the __rds_rdma_map() function, which transfers scatter-gather (sg) and pages ownership to the transport once get_mr() succeeds. If the subsequent put_user() call copying the generated cookie back to user space fails, the error path incorrectly frees those resources a second time before dropping the Memory Region (MR) reference. The kernel fix removes the duplicate unpin/free from the put_user() failure branch so MR teardown occurs only through the existing final cleanup path.

Critical Impact
A local user triggering a copy-to-user failure during RDS RDMA mapping can cause a double-free of pinned pages and scatter-gather lists in the kernel, leading to memory corruption or denial of service.

Affected Products

Linux kernel (mainline) — net/rds subsystem
Linux kernel stable branches receiving the referenced backports
Distributions shipping kernels with RDS RDMA support enabled

Discovery Timeline

2026-05-27 - CVE-2026-46053 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46053

Vulnerability Analysis

The vulnerability is a double-free condition [CWE-415] in the Linux kernel net/rds RDMA mapping path. The function __rds_rdma_map() pins user pages and builds a scatter-gather list to register a Memory Region for RDMA operations. Once get_mr() returns successfully, ownership of the pinned pages and the sg list passes to the transport layer, which is responsible for releasing them when the MR reference count drops to zero.

After the MR is registered, the code generates a cookie identifying the new region and copies it to user space with put_user(). If that copy fails, the original error handler unpinned the pages and freed the sg list inline before dropping the MR reference. The MR final-cleanup path then released the same resources again, producing a double-free.

Root Cause

The root cause is incorrect resource ownership tracking on an error path. After transport ownership transfer, the code retained logic that assumed the caller still owned the pages and sg list. The duplicate unpin/free in the put_user() failure branch conflicted with the cleanup performed when the final MR reference is released.

Attack Vector

A local user with permission to open an RDS socket and issue RDMA map ioctls can trigger the condition by supplying a user-space cookie destination address that causes put_user() to fail, such as an unmapped or read-only address. The resulting double-free corrupts kernel slab metadata and can be leveraged for denial of service or, depending on heap state and kernel hardening, further memory corruption.

No verified public exploit code is available. Technical details are described in the upstream commits referenced by the Kernel Git Commit Update.

Detection Methods for CVE-2026-46053

Indicators of Compromise

Kernel oops or panic messages referencing rds_rdma, __rds_rdma_map, or slab double-free detectors such as kfree / SLUB: double free traces.
Unexpected process terminations or system instability on hosts where unprivileged users have access to RDS sockets (AF_RDS).
KASAN reports flagging use-after-free or double-free in net/rds/rdma.c.

Detection Strategies

Audit running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts.
Enable KASAN and slab debugging on test kernels to surface the double-free during fuzzing of the RDS ioctl interface.
Monitor auditd for processes opening AF_RDS sockets followed by RDS_GET_MR or RDS_GET_MR_FOR_DEST ioctl calls from non-administrative users.

Monitoring Recommendations

Collect and review dmesg output for crashes referencing RDS or RDMA call sites.
Forward kernel logs to a centralized logging or SIEM platform and alert on slab corruption signatures.
Track loaded kernel modules and disable rds and rds_rdma where they are not required.

How to Mitigate CVE-2026-46053

Immediate Actions Required

Apply the upstream kernel patches referenced for this CVE and rebuild or upgrade to a fixed stable kernel.
If patching is not immediate, blacklist the rds and rds_rdma modules on systems that do not require RDS RDMA functionality.
Restrict local access to systems exposing RDS sockets and review which users can open AF_RDS sockets.

Patch Information

The fix removes the duplicate unpin/free from the put_user() failure branch in __rds_rdma_map(). Apply one of the upstream commits matching your kernel branch:

Workarounds

Unload the rds_rdma and rds modules on hosts that do not use RDS: modprobe -r rds_rdma rds.
Add install rds /bin/true and install rds_rdma /bin/true entries in /etc/modprobe.d/ to prevent on-demand loading.
Limit local interactive access on RDMA-enabled hosts to trusted administrators until kernels are patched.

bash

# Configuration example: prevent RDS modules from loading
echo 'install rds /bin/true'      | sudo tee /etc/modprobe.d/disable-rds.conf
echo 'install rds_rdma /bin/true' | sudo tee -a /etc/modprobe.d/disable-rds.conf
sudo modprobe -r rds_rdma rds 2>/dev/null || true
lsmod | grep -E 'rds|rds_rdma' || echo 'RDS modules not loaded'