CVE-2026-45891

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the hns3 network driver. In the hns3 set ringparam() function, a temporary copy tmp rings of the ring structure is created for rollback purposes, but the tx spare pointer in the original ring handle continues to point to the old backup memory. If memory allocation subsequently fails within the hns3 init all ring() function during setup, the error handling path attempts to free all newly allocated rings. Because tx spare contains a stale pointer, it is incorrectly identified as a newly allocated buffer and freed again, resulting in a double-free of the backup memory. This occurs because the tx spare field was not cleared after being saved in tmp rings, leaving a dangling pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.