CVE-2026-64118

A flaw was found in the Linux kernel's qed driver. This vulnerability involves a double free error in the qed_cxt_tables_alloc() function, where memory is deallocated twice if a Connection ID (CID) bitmap allocation fails. This can lead to memory corruption, potentially allowing a local attacker to cause a system crash (denial of service) or execute unauthorized code.

A double-free can occur in the qed driver error path when a later PF/VF CID bitmap allocation fails. qed_cid_map_alloc() frees previously allocated CID bitmap pointers on failure, and the outer cleanup path can later call qed_cid_map_free() and free the same pointers again. The realistic trigger is local and difficult because it depends on device specific qed initialization or recovery plus an allocation failure at the right point. For the CVSS the PR:L is used in the paranoid score to cover environments where a non-root local actor can influence memory pressure or delegated device recovery while the vulnerable driver path is exercised. Impact is at least local denial of service via kernel crash. In the worst defensible case, double-free memory corruption may allow confidentiality or integrity impact and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.