CVE-2026-45891 - Vulnerability Details

- net: hns3: fix double free issue for tx spare buffer

Description

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix double free issue for tx spare buffer

In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure
is created for rollback. However, the tx_spare pointer in the original
ring handle is incorrectly left pointing to the old backup memory.

Later, if memory allocation fails in hns3_init_all_ring() during the setup,
the error path attempts to free all newly allocated rings. Since tx_spare
contains a stale (non-NULL) pointer from the backup, it is mistaken for
a newly allocated buffer and is erroneously freed, leading to a double-free
of the backup memory.

The root cause is that the tx_spare field was not cleared after its value
was saved in tmp_rings, leaving a dangling pointer.

Fix this by setting tx_spare to NULL in the original ring structure
when the creation of the new `tx_spare` fails. This ensures the
error cleanup path only frees genuinely newly allocated buffers.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs in the hns3 network driver of the Linux kernel. During ring parameter configuration, a temporary copy of the ring structure is created for rollback. The tx_spare pointer in the original ring remains pointing to the old backup memory after a failure during allocation. Later, when the error cleanup path attempts to free newly allocated rings, this stale pointer is mistakenly freed as a new buffer, causing a double‑free. This double‑free flaw, classified as CWE‑825, leads to memory corruption in the kernel.

Affected Systems

All Linux kernel releases that include the hns3 driver are potentially affected. The CPE entry indicates the Linux kernel, and no specific version ranges are provided, so any kernel containing the hns3 driver before the fix is at risk until patched.

Risk and Exploitability

The CVSS score is 5.5. The EPSS score is < 1%. The vulnerability is not listed in CISA's KEV catalog. This double‑free flaw can lead to memory corruption in the Linux kernel. Based on the fact that the flaw occurs at privileged kernel level, it is inferred that exploitation would require an attacker with local access to the system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`907676b130711fd1f627824559e92259db2061d1`	affected	< fb6a4c376d454b425555b1b0bda36e99f56ec307
`907676b130711fd1f627824559e92259db2061d1`	affected	< 43015461662d41dcfb3bb95fadd8a2a42ad8eacf
`907676b130711fd1f627824559e92259db2061d1`	affected	< 6dc10494cfe27b6f1e9adb7e293293ae39c50b7c
`907676b130711fd1f627824559e92259db2061d1`	affected	< d2c785733dfb853ea0b53984c75662a1af230a94
`907676b130711fd1f627824559e92259db2061d1`	affected	< fdbccddb7e7822016601829f95de4008e193f7bc
`907676b130711fd1f627824559e92259db2061d1`	affected	< c3659273860bed0c8e573b865e3769abc51225a8
`907676b130711fd1f627824559e92259db2061d1`	affected	< 6d2f142b1e4b203387a92519d9d2e34752a79dbb

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[907676b130711fd1f627824559e92259db2061d1,fb6a4c376d454b425555b1b0bda36e99f56ec307)`	affected	code_commit	—
`[907676b130711fd1f627824559e92259db2061d1,43015461662d41dcfb3bb95fadd8a2a42ad8eacf)`	affected	code_commit	—
`[907676b130711fd1f627824559e92259db2061d1,6dc10494cfe27b6f1e9adb7e293293ae39c50b7c)`	affected	code_commit	—
`[907676b130711fd1f627824559e92259db2061d1,d2c785733dfb853ea0b53984c75662a1af230a94)`	affected	code_commit	—
`[907676b130711fd1f627824559e92259db2061d1,fdbccddb7e7822016601829f95de4008e193f7bc)`	affected	code_commit	—
`[907676b130711fd1f627824559e92259db2061d1,c3659273860bed0c8e573b865e3769abc51225a8)`	affected	code_commit	—
`[907676b130711fd1f627824559e92259db2061d1,6d2f142b1e4b203387a92519d9d2e34752a79dbb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	semver	—
`[0,5.14)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel patch that includes the fix for the hns3 double‑free bug
Reboot the system after the patch to ensure the driver loads the new code
If a patch cannot be applied immediately, consider disabling the hns3 driver or preventing its load on systems where it is not needed to avoid the double‑free path

Generated by OpenCVE AI on May 28, 2026 at 17:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf
https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb
https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c
https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8
https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94
https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307
https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc
https://lore.kernel.org/linux-cve-announce/2026052717-CVE-2026-45891-8561@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45891
https://www.cve.org/CVERecord?id=CVE-2026-45891

History

Thu, 28 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-415

Thu, 28 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026052717-CVE-2026-45891-8561@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45891 https://www.cve.org/CVERecord?id=CVE-2026-45891
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure is created for rollback. However, the tx_spare pointer in the original ring handle is incorrectly left pointing to the old backup memory. Later, if memory allocation fails in hns3_init_all_ring() during the setup, the error path attempts to free all newly allocated rings. Since tx_spare contains a stale (non-NULL) pointer from the backup, it is mistaken for a newly allocated buffer and is erroneously freed, leading to a double-free of the backup memory. The root cause is that the tx_spare field was not cleared after its value was saved in tmp_rings, leaving a dangling pointer. Fix this by setting tx_spare to NULL in the original ring structure when the creation of the new `tx_spare` fails. This ensures the error cleanup path only frees genuinely newly allocated buffers.
Title		net: hns3: fix double free issue for tx spare buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8 https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94 https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307 https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:17:02.306Z

Updated: 2026-05-27T12:17:02.306Z

Reserved: 2026-05-13T15:03:33.083Z

Link: CVE-2026-45891

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:03.183

Modified: 2026-05-27T14:48:31.480

Link: CVE-2026-45891

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45891 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T17:15:21Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object