Executive brief
A vulnerability was identified in the Linux kernel's VMware Paravirtual RDMA (PVRDMA) driver. This issue occurs during specific error handling scenarios when allocating user contexts, potentially leading to a system crash or instability. In a business environment, this could result in a denial-of-service for virtualized workloads relying on high-performance networking.
Technical details
A double-free vulnerability exists in the RDMA/vmw_pvrdma driver within the pvrdma_alloc_ucontext() error path. The root cause is an explicit call to pvrdma_uar_free() when an error occurs during ib_copy_to_udata(), despite the fact that the subsequent call to pvrdma_dealloc_ucontext() also performs the same cleanup. An attacker with local access could potentially trigger this error path to cause a kernel panic or other memory corruption issues. The issue has been resolved by removing the redundant free call in the error handling logic. Patches are available in various stable kernel branches.
Affected products
- Linux Linux Kernel vmw_pvrdma driver
Timeline
- 2026-04-28: other: Patch authored by Jason Gunthorpe
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0c63333ff97bd1275294fd12840a0efe9d7a4c59
- https://git.kernel.org/stable/c/45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0
- https://git.kernel.org/stable/c/935ee27d0904aa944cbcc979094c20e5ef62eead
- https://git.kernel.org/stable/c/e38e86995df27f1f854063dab1f0c6a513db3faf
- https://git.kernel.org/stable/c/ecc36a82ecfcfdf3c6606d209f22ec5543c410e0