CVE-2026-45891

Analyzed Analyzed - Analysis Complete

Double Free in Linux Kernel HNS3 Driver

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure is created for rollback. However, the tx_spare pointer in the original ring handle is incorrectly left pointing to the old backup memory. Later, if memory allocation fails in hns3_init_all_ring() during the setup, the error path attempts to free all newly allocated rings. Since tx_spare contains a stale (non-NULL) pointer from the backup, it is mistaken for a newly allocated buffer and is erroneously freed, leading to a double-free of the backup memory. The root cause is that the tx_spare field was not cleared after its value was saved in tmp_rings, leaving a dangling pointer. Fix this by setting tx_spare to NULL in the original ring structure when the creation of the new `tx_spare` fails. This ensures the error cleanup path only frees genuinely newly allocated buffers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45891

EUVD

EUVD-2026-32357

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.128 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.75 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.165 (exc)
linux	linux_kernel	From 5.14 (inc) to 5.15.202 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's hns3 network driver, specifically in the function hns3_set_ringparam(). A temporary copy of the ring structure is created for rollback purposes, but the tx_spare pointer in the original ring structure incorrectly continues to point to old backup memory.

If memory allocation fails later during the setup in hns3_init_all_ring(), the error handling code attempts to free all newly allocated rings. Because tx_spare still points to the old backup memory (a stale pointer), it is mistakenly freed again, causing a double-free of the backup memory.

The root cause is that the tx_spare pointer was not cleared (set to NULL) after its value was saved in the temporary copy, leaving a dangling pointer that leads to erroneous double freeing.

The fix involves setting tx_spare to NULL in the original ring structure when the creation of a new tx_spare fails, ensuring that only genuinely newly allocated buffers are freed during error cleanup.

Impact Analysis

This vulnerability can lead to a double-free condition in the Linux kernel's network driver, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting memory corruption.

Because the double-free occurs in kernel memory management, it can compromise the reliability and security of the affected system, potentially leading to denial of service or other security breaches.

Mitigation Strategies

The vulnerability is fixed by ensuring that the tx_spare pointer is set to NULL after its value is saved in the temporary ring structure, preventing a double-free error.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix for the hns3 driver.

Hi! I’m here to help you understand CVE-2026-45891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70