In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix mr->map double free
rxe_mr_cleanup() which tries to free mr->map again will be called when rxe_mr_init_user() fails:
CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x5d panic+0x19e/0x349 end_report.part.0+0x54/0x7c kasan_report.cold+0xa/0xf rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe] __rxe_cleanup+0x10a/0x1e0 [rdma_rxe] rxe_reg_user_mr+0xb7/0xd0 [rdma_rxe] ib_uverbs_reg_mr+0x26a/0x480 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x1a2/0x250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1397/0x15a0 [ib_uverbs]
This issue was firstly exposed since commit b18c7da63fcb ("RDMA/rxe: Fix memory leak in error path code") and then we fixed it in commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()") but this fix was reverted together at last by commit 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")
Simply let rxe_mr_cleanup() always handle freeing the mr->map once it is successfully allocated.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-headersUpgrade kernel-cross-headersUpgrade kernel-toolsUpgrade kernel-rtUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-docUpgrade kernel-rt-debug-develUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-zfcpdump-core | Dec 10, 2025 | Dec 8, 2025 |
| Debian | — | Upgrade linux | Oct 9, 2025 | Oct 9, 2025 |
| Oracle_linux | — | Upgrade kernel | Dec 10, 2025 | Oct 7, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 9, 2025 | Oct 7, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-kvmUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debugUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-rt-develUpgrade perf-debuginfoUpgrade kernel-coreUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-debug-debuginfo | Feb 5, 2026 | Dec 13, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub