CVE-2026-46189

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

HIGH
7.8
CVSS Score
Published: May 28, 2026 at 09:36 AM UTC
Updated: September 9, 2026 at 05:27 PM UTC
2 products affected across 2 vendorsLinux KernelEnterprise Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.10 ≤ v < 5.10.2584.10 ≤ v < 5.15.2094.10 ≤ v < 6.1.1754.10 ≤ v < 6.12.884.10 ≤ v < 6.18.304.10 ≤ v < 6.6.1404.10 ≤ v < 7.0.74.10 ≤ v < 7.15.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1756.13 ≤ v < 6.18.306.19 ≤ v < 7.0.76.2 ≤ v < 6.6.1406.7 ≤ v < 6.12.8829c8d9eba550c6d73d17cc1618a9f5f2a7345aa17.1 rc17.1 rc2
Vendor states this is fixed in 0c63333ff97bd1275294fd12840a0efe9d7a4c59 (fixed)
Vendor states this is fixed in 1df5711121cdc11e76b889408fdbe459feba1d39 (fixed)
Vendor states this is fixed in 269967d7693304e1f06ed2dff4ebbbeeb397cda4 (fixed)
Vendor states this is fixed in 3a231c34c5bc3d3cfc850b877758ec9fdaa8a483 (fixed)
Vendor states this is fixed in 45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0 (fixed)
Vendor states this is fixed in 935ee27d0904aa944cbcc979094c20e5ef62eead (fixed)
Vendor states this is fixed in e38e86995df27f1f854063dab1f0c6a513db3faf (fixed)
Vendor states this is fixed in ecc36a82ecfcfdf3c6606d209f22ec5543c410e0 (fixed)
Vendor states this is fixed in 4.10 (unaffected)
Vendor states this is fixed in 5.10.258 (unaffected)
Vendor states this is fixed in 5.15.209 (unaffected)
Vendor states this is fixed in 6.1.175 (unaffected)
Vendor states this is fixed in 6.12.88 (unaffected)
Vendor states this is fixed in 6.18.30 (unaffected)
Vendor states this is fixed in 6.6.140 (unaffected)
Vendor states this is fixed in 7.0.7 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)
Vendor states this is fixed in 0:4.18.0-305.199.1.el8_4 (unaffected)
Vendor states this is fixed in 0:4.18.0-372.201.1.el8_6 (unaffected)
Vendor states this is fixed in 0:4.18.0-477.152.1.el8_8 (unaffected)
Vendor states this is fixed in 0:4.18.0-553.139.1.el8_10 (unaffected)
Vendor states this is fixed in 0:4.18.0-553.139.1.rt7.480.el8_10 (unaffected)
Vendor states this is fixed in 0:5.14.0-284.179.1.el9_2 (unaffected)
Vendor states this is fixed in 0:5.14.0-284.179.1.rt14.464.el9_2 (unaffected)
Vendor states this is fixed in 0:5.14.0-427.136.1.el9_4 (unaffected)
Vendor states this is fixed in 0:5.14.0-570.127.1.el9_6 (unaffected)
Vendor states this is fixed in 0:5.14.0-687.19.1.el9_8 (unaffected)
Vendor states this is fixed in 0:6.12.0-211.29.1.el10_2 (unaffected)
Vendor states this is fixed in 6 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-415CWE-1341CWE-763

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card