{"id":"CVE-2026-45891","title":"net: hns3: fix double free issue for tx spare buffer","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix double free issue for tx spare buffer\n\nIn hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure\nis created for rollback. However, the …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 907676b130711fd1f627824559e92259db2061d1 < fb6a4c376d454b425555b1b0bda36e99f56ec307","Linux >= 907676b130711fd1f627824559e92259db2061d1 < 43015461662d41dcfb3bb95fadd8a2a42ad8eacf","Linux >= 907676b130711fd1f627824559e92259db2061d1 < 6dc10494cfe27b6f1e9adb7e293293ae39c50b7c","Linux >= 907676b130711fd1f627824559e92259db2061d1 < d2c785733dfb853ea0b53984c75662a1af230a94","Linux >= 907676b130711fd1f627824559e92259db2061d1 < fdbccddb7e7822016601829f95de4008e193f7bc","Linux >= 907676b130711fd1f627824559e92259db2061d1 < c3659273860bed0c8e573b865e3769abc51225a8","Linux >= 907676b130711fd1f627824559e92259db2061d1 < 6d2f142b1e4b203387a92519d9d2e34752a79dbb","Linux 5.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:43:41.206482Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:53:11.090Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45891","references":[{"url":"https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307"},{"url":"https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf"},{"url":"https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c"},{"url":"https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94"},{"url":"https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc"},{"url":"https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8"},{"url":"https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb"}],"tags":["cve.org"],"epss":0.0013,"epssPercentile":0.02626,"ingestedAt":"2026-11-06T16:57:43.390Z","slug":"CVE-2026-45891","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix double free issue for tx spare buffer\n\nIn hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure\nis created for rollback. However, the tx_spare pointer in the original\nring handle is incorrectly left pointing to the old backup memory.\n\nLater, if memory allocation fails in hns3_init_all_ring() during the setup,\nthe error path attempts to free all newly allocated rings. Since tx_spare\ncontains a stale (non-NULL) pointer from the backup, it is mistaken for\na newly allocated buffer and is erroneously freed, leading to a double-free\nof the backup memory.\n\nThe root cause is that the tx_spare field was not cleared after its value\nwas saved in tmp_rings, leaving a dangling pointer.\n\nFix this by setting tx_spare to NULL in the original ring structure\nwhen the creation of the new `tx_spare` fails. This ensures the\nerror cleanup path only frees genuinely newly allocated buffers.\n\n## Affected\n\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < fb6a4c376d454b425555b1b0bda36e99f56ec307`\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < 43015461662d41dcfb3bb95fadd8a2a42ad8eacf`\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < 6dc10494cfe27b6f1e9adb7e293293ae39c50b7c`\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < d2c785733dfb853ea0b53984c75662a1af230a94`\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < fdbccddb7e7822016601829f95de4008e193f7bc`\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < c3659273860bed0c8e573b865e3769abc51225a8`\n- `Linux >= 907676b130711fd1f627824559e92259db2061d1 < 6d2f142b1e4b203387a92519d9d2e34752a79dbb`\n- `Linux 5.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}