LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-45852 is a Linux kernel memory-management flaw in the RDMA/rxe component. A local low-privileged user could trigger an error path that frees the same queue twice, potentially crashing the system or affecting kernel memory integrity. The provided sources do not show active exploitation.

Executive priority

Prioritize patching on multi-user Linux servers, virtualization hosts, research clusters, and systems where local users or workloads are not fully trusted. This is high severity but not currently supported by evidence of internet-scale or active exploitation.

Technical view

In rxe_srq_from_init(), srq->rq.queue is set before copy_to_user(). If that copy fails, rxe_queue_cleanup() frees q, then rxe_create_srq cleanup can call rxe_srq_cleanup() and free the same queue again. The upstream fix moves assignment until after the user copy succeeds.

Likely exposure

Exposure is most relevant on Linux systems using or allowing the RDMA/rxe kernel component. Risk is higher where local shell, container, or workload users have low-privileged access. The source data lists Linux as affected and references multiple stable kernel fixes and Red Hat advisories.

Exploitation context

The CVSS vector is local, low complexity, low privileges required, and no user interaction. KEV is false in the source bundle, and no cited source establishes active exploitation. Treat this as a local kernel privilege-impact and availability risk until vendor status is confirmed.

Researcher notes

The vulnerability is in an error-handling path for SRQ creation in RDMA/rxe. The key condition is copy_to_user() failure after srq->rq.queue receives q. Source evidence supports the double-free root cause and fix direction, but not exploit availability or distribution-specific fixed versions beyond referenced advisories.

Mitigation direction

  • Apply the relevant Linux stable kernel update or vendor advisory package.
  • Prioritize Red Hat systems covered by the referenced RHSA advisories.
  • Check vendor guidance for exact fixed builds in your distribution.
  • Reduce unnecessary local user access on systems exposing RDMA/rxe.
  • Disable unused RDMA/rxe functionality only if vendor guidance supports it.

Validation and detection

  • Inventory Linux kernel versions across servers and workstations.
  • Identify systems with the rdma_rxe component available or loaded.
  • Compare kernel builds against upstream stable commits and vendor advisories.
  • Review Red Hat CVE and Bugzilla entries for product-specific status.
  • Confirm updates through normal package or kernel version reporting.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-45852 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
1ADP providers
22Source links

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7CVSS 3.1HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-45852Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Reported to Red Hat.

  3. ADP timelineredhat-SADP

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

redhat-SADPkernel: RDMA/rxe: Fix double free in rxe_srq_from_init
other:Red Hat severity ratingcvssV3_1
  • 2026-05-27T00:00:00.000Z: Reported to Red Hat.
  • 2026-05-27T00:00:00.000Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, aae0484e15f062ad2c2502e68e15dfb8b8f84608, 350703fae672d4d649c3562c199eab5ec9dc7c79, 4.19.86unaffected
LinuxLinux4.20, 0, 5.10.259, 5.15.210, 6.1.176, 6.6.128, 6.12.75, 6.18.14, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.