CVE-2026-45891

A flaw was found in the Linux kernel's hns3 network driver. This double-free vulnerability occurs due to incorrect handling of the tx_spare buffer during ring parameter setup. If memory allocation fails in the error cleanup path, a stale pointer to backup memory is erroneously freed twice. This can be exploited by a local attacker, potentially leading to a system crash and a denial of service (DoS).

This vulnerability is rated as Moderate because exploitation requires local access, elevated privileges to configure network interface ring parameters via ethtool, and specific HiSilicon network hardware. The flaw is triggered only during an error recovery path following an allocation failure when altering transmit ring settings on systems utilizing the hns3 driver. Consequently, systems without this specialized network hardware or unprivileged local users cannot trigger the condition, limiting the overall impact to a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.