CVE-2026-46189: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46189 Overview

CVE-2026-46189 is a double free vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically within the VMware paravirtual RDMA driver (vmw_pvrdma). The issue occurs on the error path of the pvrdma_alloc_ucontext() function, where pvrdma_uar_free() is invoked explicitly even though pvrdma_dealloc_ucontext() already calls it internally. This redundant invocation triggers a double free condition on the user access region (UAR) allocation [CWE-415]. The flaw has been resolved through upstream kernel patches.

Critical Impact
Double free conditions in kernel drivers can lead to memory corruption, kernel panics, and potential local privilege escalation when triggered by an attacker capable of invoking the affected RDMA ioctl paths.

Affected Products

Linux kernel versions containing the drivers/infiniband/hw/vmw_pvrdma driver prior to the fix commits
Systems running VMware paravirtual RDMA devices in guest virtual machines
Linux distributions shipping vulnerable stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-05-28 - CVE-2026-46189 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46189

Vulnerability Analysis

The vulnerability resides in the VMware paravirtual RDMA driver, which provides RDMA functionality to Linux guests running on VMware hypervisors. When pvrdma_alloc_ucontext() allocates a user context for an RDMA application, it reserves a UAR page through pvrdma_uar_alloc(). If a subsequent step in the allocation flow fails, the error handling path historically called pvrdma_uar_free() directly before falling through to pvrdma_dealloc_ucontext(). Because pvrdma_dealloc_ucontext() also calls pvrdma_uar_free() as part of its standard cleanup, the same UAR resource is released twice.

Root Cause

The root cause is redundant cleanup logic in the error path of pvrdma_alloc_ucontext(). The original code did not account for the fact that the deallocation helper already performs UAR release, resulting in the same allocator function being called twice against the same resource. The fix removes the premature pvrdma_uar_free() call from the error handler and lets pvrdma_dealloc_ucontext() perform the single, correct cleanup.

Attack Vector

Exploitation requires local access to a Linux system where the vmw_pvrdma driver is loaded and reachable from userspace, typically a VMware guest with RDMA enabled. An attacker capable of triggering the specific failure condition in pvrdma_alloc_ucontext() can force the double free to occur. Memory corruption resulting from a double free in kernel space may be leveraged to achieve denial of service or, with sufficient control over the heap state, kernel memory corruption. The vulnerability mechanism is described in the upstream patch series. See the Kernel Git Commit 0c63333f and related commits for technical details.

Detection Methods for CVE-2026-46189

Indicators of Compromise

Unexpected kernel panics or BUG: messages referencing pvrdma functions in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging double-free conditions in pvrdma_uar_free on kernels with sanitizers enabled
Crashes or instability in VMware guest VMs using paravirtual RDMA devices when applications open RDMA user contexts

Detection Strategies

Inventory kernel versions across Linux hosts and compare against the fixed commit hashes referenced in the upstream stable tree
Identify VMware guest VMs with the vmw_pvrdma kernel module loaded using lsmod | grep vmw_pvrdma
Monitor kernel ring buffers and syslog for memory allocator warnings (slab, kfree, double free) correlated with RDMA workloads

Monitoring Recommendations

Centralize Linux kernel logs into a SIEM and alert on kernel crash signatures involving the RDMA subsystem
Track auditd events for processes interacting with /dev/infiniband/* devices to identify which workloads exercise the affected code path
Review virtualization platform alerts for guest VM crashes that may indicate exploitation attempts or accidental triggering of the bug

How to Mitigate CVE-2026-46189

Immediate Actions Required

Apply the upstream Linux kernel patches that remove the redundant pvrdma_uar_free() call from the pvrdma_alloc_ucontext() error path
Update to a distribution kernel that incorporates the fix commits listed in the kernel.org stable tree
For systems that do not require RDMA, unload the vmw_pvrdma module to remove the attack surface entirely

Patch Information

The vulnerability has been resolved in the upstream Linux kernel through multiple stable branch backports. The relevant fixes are available at Kernel Git Commit 0c63333f, Kernel Git Commit 45d25e3e, Kernel Git Commit 935ee27d, Kernel Git Commit e38e8699, and Kernel Git Commit ecc36a82. Consume the fix through your Linux distribution's standard kernel update channels.

Workarounds

Blacklist the vmw_pvrdma module on systems that do not require RDMA functionality by adding blacklist vmw_pvrdma to /etc/modprobe.d/
Restrict access to RDMA device nodes under /dev/infiniband/ to trusted users via filesystem permissions
Where feasible, disable paravirtual RDMA devices in the VMware guest VM configuration until the kernel is patched

bash

# Configuration example: blacklist the vulnerable driver
echo "blacklist vmw_pvrdma" | sudo tee /etc/modprobe.d/disable-vmw-pvrdma.conf
sudo rmmod vmw_pvrdma 2>/dev/null || true
sudo update-initramfs -u