CVE-2026-46189: Linux Kernel RDMA vmw_pvrdma Double Free Vulnerability

Technical summary

The vulnerability exists in the vmw_pvrdma driver's error handling path within pvrdma_alloc_ucontext(). The function fails to account for the fact that pvrdma_dealloc_ucontext() will later invoke pvrdma_uar_free() during its cleanup routine. When pvrdma_alloc_ucontext() hits an error condition and immediately calls pvrdma_uar_free() before returning the error status, it leaves a stale pointer or freed memory reference that gets dereferenced again when the dealloc function runs. This violates memory safety guarantees and corresponds to CWE-1341 (Reuse of Uninitialized Variable) and CWE-415 (Double Free), allowing either a use-after-free or direct double-free condition. The kernel CVSS score of 7.8 (HIGH) reflects the local privilege escalation risk given that RDMA access requires some level of privilege but not administrative rights.

Business impact

Organizations running affected Linux kernels on systems with RDMA hardware (commonly found in high-performance computing clusters, data centers with InfiniBand interconnects, or specialized network appliances) face elevated risk of denial of service through kernel panics. More critically, an unprivileged local user with access to RDMA device context creation can potentially corrupt kernel memory, escalate privileges, or leak sensitive kernel data. In environments like HPC clusters or cloud data centers where RDMA is enabled for performance, this could allow lateral movement or persistence mechanisms within a trusted network segment.

Affected systems

The vulnerability affects the Linux kernel RDMA subsystem, specifically the vmw_pvrdma (VMware paravirtual RDMA) driver. This driver is typically used in VMware ESXi environments or when running Linux guests with RDMA support in virtualized settings. Unpatched Linux kernels with this driver compiled in are vulnerable. The vulnerability requires local system access and the ability to invoke RDMA context allocation, which is restricted to privileged or specific unprivileged users depending on system configuration.

Exploitability

Exploitability is moderate to high for systems where RDMA is enabled and accessible. The vulnerability requires local access (AV:L) and low privilege (PR:L) but no user interaction (UI:N). The double-free condition is deterministic and reliably triggered through legitimate RDMA API calls by an unprivileged user with appropriate device permissions. While it requires understanding of RDMA programming and the kernel memory allocator behavior, the technical bar for demonstrating denial of service is low. Privilege escalation exploitation is more complex but feasible given the scope impact (S:U indicates no privilege escalation boundary crossing in the vector) and the direct memory corruption capability.

Remediation

Apply the upstream Linux kernel patch that fixes the error handling in pvrdma_alloc_ucontext() to avoid the redundant pvrdma_uar_free() call. The fix removes the erroneous free operation from the error path, relying on pvrdma_dealloc_ucontext() to perform cleanup once the user context is properly initialized. Verify against the vendor advisory for the specific patch version available for your kernel release branch (5.10.x, 5.15.x, 6.1.x, 6.6.x, etc.). Systems without RDMA enabled or without the vmw_pvrdma driver in their kernel configuration are unaffected.

Patch guidance

Identify your kernel version using 'uname -r'. Check the Linux kernel security advisory or your Linux distribution's security updates for CVE-2026-46189 patches applicable to your kernel branch. For RHEL, Debian, Ubuntu, SUSE, and other distribution derivatives, verify patch availability through their respective security advisories. If RDMA/vmw_pvrdma is not in active use, disabling the driver at compile time or via module blacklisting provides immediate mitigation. Test patches in a non-production environment before rolling out broadly, particularly in HPC environments where kernel stability is critical. Schedule patching aligned with your change management process; the LOCAL + LOW privilege requirement means insider or compromised-account threat actors are the primary concern.

Detection guidance

Monitor for pvrdma-related kernel warnings, oops messages, or panics in kernel logs (dmesg, journalctl). Use kernel address sanitizers (KASAN) or memory debugging tools if available in your environment to detect double-free conditions. Network intrusion detection signatures are not applicable since this is a local kernel bug. Audit RDMA context creation calls and track which users have permission to access RDMA devices via 'ibacm', 'ibstat', or lsmod output for the pvrdma module. In high-security environments, monitor for crashes correlating with RDMA user context allocation attempts.

Why prioritize this

This vulnerability merits high priority despite not being on the KEV list because it combines HIGH severity (CVSS 7.8), local privilege escalation potential, deterministic exploitability, and presence in infrastructure-critical deployments (HPC, cloud data centers). The double-free in error-path memory management is a classic kernel vulnerability pattern with proven exploitation techniques. Organizations must prioritize patching systems with RDMA enabled, particularly in environments where least-privilege access controls are enforced and unprivileged users may interact with RDMA.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects HIGH severity: local attack vector (AV:L) limits exposure to authenticated users, but low privilege requirement (PR:L) and absence of user interaction (UI:N) lower the barrier. The impact metrics (C:H, I:H, A:H—all high) indicate that successful exploitation can compromise confidentiality, integrity, and availability. The double-free condition reliably yields memory corruption, which typically manifests as denial of service but can enable privilege escalation or information disclosure depending on heap state during exploitation. The score appropriately prioritizes this for organizations using RDMA infrastructure.

Frequently asked questions