CVE-2026-46189 — RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

Description (CNA)

In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free.

Affected (CNA)

Vendor / product	Versions
Linux / Linux	affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 269967d7693304e1f06ed2dff4ebbbeeb397cda4; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 1df5711121cdc11e76b889408fdbe459feba1d39; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 3a231c34c5bc3d3cfc850b877758ec9fdaa8a483; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before ecc36a82ecfcfdf3c6606d209f22ec5543c410e0; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 0c63333ff97bd1275294fd12840a0efe9d7a4c59; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 935ee27d0904aa944cbcc979094c20e5ef62eead; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before e38e86995df27f1f854063dab1f0c6a513db3faf
Linux / Linux	affected 4.10; unaffected 0 before 4.10; unaffected 5.10.258 through 5.10.; unaffected 5.15.209 through 5.15.; unaffected 6.1.175 through 6.1.; unaffected 6.6.140 through 6.6.; unaffected 6.12.88 through 6.12.; unaffected 6.18.30 through 6.18.; unaffected 7.0.7 through 7.0.; unaffected 7.1 through

Vendor / product

Versions

Linux / Linux

affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 269967d7693304e1f06ed2dff4ebbbeeb397cda4; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 1df5711121cdc11e76b889408fdbe459feba1d39; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 3a231c34c5bc3d3cfc850b877758ec9fdaa8a483; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before ecc36a82ecfcfdf3c6606d209f22ec5543c410e0; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 0c63333ff97bd1275294fd12840a0efe9d7a4c59; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before 935ee27d0904aa944cbcc979094c20e5ef62eead; affected 29c8d9eba550c6d73d17cc1618a9f5f2a7345aa1 before e38e86995df27f1f854063dab1f0c6a513db3faf

Linux / Linux

affected 4.10; unaffected 0 before 4.10; unaffected 5.10.258 through 5.10.*; unaffected 5.15.209 through 5.15.*; unaffected 6.1.175 through 6.1.*; unaffected 6.6.140 through 6.6.*; unaffected 6.12.88 through 6.12.*; unaffected 6.18.30 through 6.18.*; unaffected 7.0.7 through 7.0.*; unaffected 7.1 through *

CWE

No CWE identifiers supplied.

References

ADP enrichment

redhat-SADP

A flaw was found in the Linux kernel, specifically within the RDMA (Remote Direct Memory Access) vmw_pvrdma module. This vulnerability is a double free, which means the system attempts to release the same memory resource twice. This can occur in an error handling path within the `pvrdma_alloc_ucontext()` function. Exploiting this flaw could lead to memory corruption or cause the system to become unavailable, resulting in a denial of service (DoS).