CVE-2026-46053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46053", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.094Z", "datePublished": "2026-05-27T12:57:11.870Z", "dateUpdated": "2026-08-05T12:29:21.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:21.209Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix MR cleanup on copy error\n\n__rds_rdma_map() hands sg/pages ownership to the transport after\nget_mr() succeeds. If copying the generated cookie back to user space\nfails after that point, the error path must not free those resources\nagain before dropping the MR reference.\n\nRemove the duplicate unpin/free from the put_user() failure branch so\nthat MR teardown is handled only through the existing final cleanup\npath."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered through the local `setsockopt(SOL_RDS, RDS_GET_MR/RDS_GET_MR_FOR_DEST)` syscall on an RDS socket (MR-registration control plane); it is not reachable from a remote peer's network packets.\nAC:L - Once an RDMA-capable RDS socket is bound, the double-free is 100% deterministic and the attacker fully controls the trigger by supplying a bad `cookie_addr` so `put_user()` faults; there is no race or attacker-uncontrolled condition.\nPR:L - Creating an AF_RDS socket has no capability check (module auto-loads) and `can_do_mlock()` passes for normal users by default, so any unprivileged local user on a host with RDMA hardware can reach the path.\nUI:N - The attacker triggers the entire sequence with its own syscalls; no action by another user or victim is required.\nS:U - The double-free corrupts the kernel slab/page allocator within the kernel's own security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The double-free of the `sg` slab object and the page-refcount underflow yield use-after-free/cross-object primitives that can be groomed into arbitrary kernel-memory reads, enabling significant information disclosure.\nI:H - A double `kfree()` corrupts the SLUB freelist and the page-refcount underflow allows reuse of an in-use physical page, both classic primitives for arbitrary kernel write and privilege escalation.\nA:H - The double-free and page-refcount underflow readily cause heap corruption, freelist poisoning, and kernel panic/oops."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/rdma.c"], "versions": [{"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "91a44b406bc1f9e1c5da0cb7d0d5991b43b79147", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "106dc689206610cfa2098f593fdd1e020c997835", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "ec55a86f7fba7d9111df94b9c11a4755ed492995", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "8fdbb6262a4a3ed44a0830a7793903b54bb27bdc", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "d95cea9298be1ba8876e3f156be96d3a492085ca", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "033370ffb3c9c0264d19f8ba9ef769523266589a", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "b3cb8cae530b2727d8245684148bb49425f6765c", "status": "affected", "versionType": "git"}, {"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "lessThan": "8141a2dc70080eda1aedc0389ed2db2b292af5bd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/rdma.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.86", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.27", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/91a44b406bc1f9e1c5da0cb7d0d5991b43b79147"}, {"url": "https://git.kernel.org/stable/c/106dc689206610cfa2098f593fdd1e020c997835"}, {"url": "https://git.kernel.org/stable/c/ec55a86f7fba7d9111df94b9c11a4755ed492995"}, {"url": "https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc"}, {"url": "https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca"}, {"url": "https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a"}, {"url": "https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c"}, {"url": "https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd"}], "title": "net: rds: fix MR cleanup on copy error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "91a44b406bc1f9e1c5da0cb7d0d5991b43b79147", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "106dc689206610cfa2098f593fdd1e020c997835", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "ec55a86f7fba7d9111df94b9c11a4755ed492995", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "8fdbb6262a4a3ed44a0830a7793903b54bb27bdc", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "d95cea9298be1ba8876e3f156be96d3a492085ca", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "033370ffb3c9c0264d19f8ba9ef769523266589a", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "b3cb8cae530b2727d8245684148bb49425f6765c", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}, {"lessThan": "8141a2dc70080eda1aedc0389ed2db2b292af5bd", "status": "affected", "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.86", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.27", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CECDB7D-8788-4E11-AE2E-F12105520BA6", "versionEndExcluding": "5.10.258", "versionStartIncluding": "5.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6:-:*:*:*:*:*:*", "matchCriteriaId": "A92F7A0E-C302-4FEA-9EF3-1A3D5CF3AD54", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc3:*:*:*:*:*:*", "matchCriteriaId": "7D3107F6-EB44-4C65-AA1B-1E96923F6409", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc4:*:*:*:*:*:*", "matchCriteriaId": "DC0C894E-6323-44E5-89DD-8FB6A5C41CAF", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc5:*:*:*:*:*:*", "matchCriteriaId": "4C76EAC9-C2E6-4B6F-B002-ADBE74DDD794", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc6:*:*:*:*:*:*", "matchCriteriaId": "F13B8FBF-E007-4F60-A290-2833B45F8520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc7:*:*:*:*:*:*", "matchCriteriaId": "CD0276C4-2C60-4C52-AC89-F96DF991B858", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix MR cleanup on copy error\n\n__rds_rdma_map() hands sg/pages ownership to the transport after\nget_mr() succeeds. If copying the generated cookie back to user space\nfails after that point, the error path must not free those resources\nagain before dropping the MR reference.\n\nRemove the duplicate unpin/free from the put_user() failure branch so\nthat MR teardown is handled only through the existing final cleanup\npath."}], "id": "CVE-2026-46053", "lastModified": "2026-06-17T10:52:59.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-27T14:17:24.937", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/106dc689206610cfa2098f593fdd1e020c997835"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/91a44b406bc1f9e1c5da0cb7d0d5991b43b79147"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec55a86f7fba7d9111df94b9c11a4755ed492995"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: rds: fix MR cleanup on copy error", "id": "2481966", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481966"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) network protocol. When handling memory registration (MR) cleanup, specifically during the process of copying generated cookies back to user space, an error in the cleanup path could lead to resources being freed multiple times. This incorrect resource handling could result in system instability or a denial of service."], "name": "CVE-2026-46053", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46053\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46053\nhttps://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46053-a24e@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d4597c8c5abdeeaf50774066c16683f30184dc8,8fdbb6262a4a3ed44a0830a7793903b54bb27bdc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d4597c8c5abdeeaf50774066c16683f30184dc8,d95cea9298be1ba8876e3f156be96d3a492085ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d4597c8c5abdeeaf50774066c16683f30184dc8,033370ffb3c9c0264d19f8ba9ef769523266589a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d4597c8c5abdeeaf50774066c16683f30184dc8,b3cb8cae530b2727d8245684148bb49425f6765c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d4597c8c5abdeeaf50774066c16683f30184dc8,8141a2dc70080eda1aedc0389ed2db2b292af5bd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.86,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.27,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.4,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-27T20:30:40.558435+00:00", "title": "Linux Kernel RDS Transport Resource Mismanagement Leading to Potential Kernel Crash", "updated": "2026-06-18T07:45:03.626136+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}