Linux kernel vmw_pvrdma: double free on ucontext allocation error path

Impact

A local user who can open the paravirtual RDMA device can force the ucontext allocation to fail and trigger a double free, because pvrdma_uar_free() is called both directly and again inside pvrdma_dealloc_ucontext(). Freeing the same UAR object twice corrupts kernel allocator state, which is the classic starting point for local privilege escalation on a shared node. This only matters on guests running under VMware with the paravirtual RDMA adapter attached - it is not the mlx5/ConnectX path most GPU fabrics use, so a bare-metal or non-VMware fleet is unaffected. Where it does apply, a tenant VM with RDMA verbs access can escalate inside the guest.

Who can reach it

Local user inside a VMware guest with access to the pvrdma verbs device (/dev/infiniband/uverbsN). Authentication as an ordinary local user is required; no remote or fabric-side path.

What to do

Take the stable kernel fix (commits linked in the record) or the Red Hat errata kernel for RHEL 8/9/10, then reboot each affected guest. If the fleet does not use VMware paravirtual RDMA, unbinding or not attaching the pvrdma adapter removes the exposure without a reboot. No fixed version string is stated beyond the referenced stable commits.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-46197 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• FreeBSD ZFS: size truncation in ZFS_IOC_USERSPACE_MANY gives a local user a kernel heap overflowCVE-2026-49429 · FreeBSD ZFS (ZFS_IOC_USERSPACE_MANY ioctl)High
• Linux kernel SO_REUSEPORT: cBPF program freed without an RCU grace period, use-after-free in UDP receiveCVE-2026-52910 · Linux kernel net/core sock_reuseport (cBPF program freed without RCU grace period)High
• Linux kernel io_uring poll: cancel flag makes the ownership slowpath unreachableCVE-2026-52933 · Linux kernel io_uring (io_poll_get_ownership signed refcount comparison)High
• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel PSI: use-after-free racing a cgroup pressure write against cgroup removalCVE-2026-52991 · Linux kernel sched/psi (cgroup pressure files)High