CVE-2026-46053

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) network protocol. When handling memory registration (MR) cleanup, specifically during the process of copying generated cookies back to user space, an error in the cleanup path could lead to resources being freed multiple times. This incorrect resource handling could result in system instability or a denial of service.

A moderate-impact flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol, in the RDMA memory registration (MR) path. In __rds_rdma_map(), once get_mr() has succeeded, ownership of the pinned pages and scatterlist is handed to the transport. If the subsequent copy of the generated MR cookie back to user space fails, the error path could unpin the pages and free the scatterlist even though those resources are still owned by the transport and are freed again during final MR teardown, resulting in a double free or page lifetime corruption. A local user with access to the RDS RDMA interface who supplies a user-space destination pointer that fails the copy could trigger this error path, causing kernel memory corruption that most likely results in a kernel panic and denial of service. Red Hat Product Security rates this flaw as Moderate impact, lower than the High severity implied by the CVE.org CVSS score of 7.8, because triggering the flaw requires local access with privileges to use the RDS RDMA interface and the primary expected consequence is denial of service. Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (both the kernel and kernel-rt components) and Red Hat In-Vehicle OS 2.0 are not affected by this vulnerability because the vulnerable code is not present in the kernel versions shipped for those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.