CVE-2026-45891

Description

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure is created for rollback. However, the tx_spare pointer in the original ring handle is incorrectly left pointing to the old backup memory. Later, if memory allocation fails in hns3_init_all_ring() during the setup, the error path attempts to free all newly allocated rings. Since tx_spare contains a stale (non-NULL) pointer from the backup, it is mistaken for a newly allocated buffer and is erroneously freed, leading to a double-free of the backup memory. The root cause is that the tx_spare field was not cleared after its value was saved in tmp_rings, leaving a dangling pointer. Fix this by setting tx_spare to NULL in the original ring structure when the creation of the new `tx_spare` fails. This ensures the error cleanup path only frees genuinely newly allocated buffers.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.1 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): —
Reserved: 2026-05-13
Published: 2026-05-27 12:17 UTC
Last updated: 2026-05-27 12:17 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45891.json
Linked Threat: CVE-2026-45891 — CVE-2026-45891

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-27 14:17:03 UTC
NVD last modified: 2026-06-25 21:11:03 UTC
NVD CVSS v3.1: 7.8 / 10 HIGH source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0013 (probability of exploitation in next 30 days)
EPSS percentile: 2.95% vs all CVEs — higher = more likely to be exploited, as of 2026-07-26

NVD-assigned CWE(s): CWE-415 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-32357
Assigner: Linux
Published: May 27, 2026, 12:17:02 PM
Updated: May 27, 2026, 12:17:02 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.1300
Vendors: Linux
Products: Linux (patch: 6.19.4)

Linux (907676b130711fd1f627824559e92259db2061d1 <6dc10494cfe27b6f1e9adb7e293293ae39c50b7c)

Linux (907676b130711fd1f627824559e92259db2061d1 <fb6a4c376d454b425555b1b0bda36e99f56ec307)

Linux (907676b130711fd1f627824559e92259db2061d1 <43015461662d41dcfb3bb95fadd8a2a42ad8eacf)

Linux (patch: 6.1.165)

Linux (907676b130711fd1f627824559e92259db2061d1 <6d2f142b1e4b203387a92519d9d2e34752a79dbb)

Linux (patch: 6.18.14)

Linux (patch: 0)

Linux (5.14)

Linux (patch: 5.15.202)

Linux (907676b130711fd1f627824559e92259db2061d1 <fdbccddb7e7822016601829f95de4008e193f7bc)

Linux (907676b130711fd1f627824559e92259db2061d1 <d2c785733dfb853ea0b53984c75662a1af230a94)

Linux (907676b130711fd1f627824559e92259db2061d1 <c3659273860bed0c8e573b865e3769abc51225a8)

Linux (patch: 6.12.75)

Linux (patch: 6.6.128)

Linux (patch: 7.0)
Aliases: GHSA-h6g2-742c-p38f

ENISA description: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure is created for rollback. However, the tx_spare pointer in the original ring handle is incorrectly left pointing to the old backup memory. Later, if memory allocation fails in hns3_init_all_ring() during the setup, the error path attempts to free all newly allocated rings. Since tx_spare contains a stale (non-NULL) pointer from the backup, it is mistaken for a newly allocated buffer and is erroneously freed, leading to a double-free of the backup memory. The root cause is that the tx_spare field was not cleared after its value was saved in tmp_rings, leaving a dangling pointer. Fix this by setting tx_spare to NULL in the original ring structure when the creation of the new `tx_spare` fails. This ensures the error cleanup path only frees genuinely newly allocated buffers.

EUVD references (7)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`907676b130711fd1f627824559e92259db2061d1` (affected), `907676b130711fd1f627824559e92259db2061d1` (affected), `907676b130711fd1f627824559e92259db2061d1` (affected), `907676b130711fd1f627824559e92259db2061d1` (affected), `907676b130711fd1f627824559e92259db2061d1` (affected), `907676b130711fd1f627824559e92259db2061d1` (affected), `907676b130711fd1f627824559e92259db2061d1` (affected)	—
Linux	Linux	`5.14` (affected), `0` (unaffected), `5.15.202` (unaffected), `6.1.165` (unaffected), `6.6.128` (unaffected), `6.12.75` (unaffected), `6.18.14` (unaffected), `6.19.4` (unaffected), `7.0` (unaffected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf tenable:git.kernel.org
https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb tenable:git.kernel.org
https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c tenable:git.kernel.org
https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8 tenable:git.kernel.org
https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94 tenable:git.kernel.org
https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307 tenable:git.kernel.org
https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc tenable:git.kernel.org
https://nvd.nist.gov/vuln/detail/CVE-2026-45891 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-45891 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (7)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch

Remediations (17)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-41089 Netlogon RCE: Patch Domain Controllers

web:blog.gridinsoft.com

CVE - 2026 -41089 in Windows Netlogon is now reported as actively exploited. Patch domain controllers and check LSASS, Netlogon, and authentication logs.

2026-06-04 00:16 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-06-04 00:16 UTC
GitHub - 0xBlackash/CVE-2026-41091: CVE-2026-41091

web:github.com

CVE ID: CVE - 2026 -41091 Vulnerability Type: Improper Link Resolution Before File Access (CWE-59 - Link Following) Affected Component: Microsoft Malware Protection Engine Root Cause: Defender fails to properly resolve links/junctions during cloud-tagged file remediation /rollback, allowing redirection of privileged writes. Impact: Local authenticated attacker can escalate from standard user to ...

2026-06-04 00:16 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-06-04 00:16 UTC
Nvd - Cve-2026-41089

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-06-04 00:16 UTC
Microsoft Defender Vulnerabilities Added to CISA KEV (CVE-2026-41091 ...

web:op-c.net

CISA added two actively exploited Microsoft Defender vulnerabilities, CVE - 2026 -41091 and CVE - 2026 -45498, to its KEV catalog. Learn the risks and recommended actions.

2026-06-04 00:16 UTC
Netlogon RCE CVE-2026-41089 Flaw | Orca Security

web:orca.security

Critical Netlogon RCE CVE - 2026 -41089 puts Windows Server domain controllers at risk. Use Orca Security to detect unpatched instances and protect your AD.

2026-06-04 00:16 UTC
CVE-2026-41089: Windows Netlogon Critical RCE — Detection and ...

web:securityarsenal.com

A critical CVSS 9.8 flaw in Windows Netlogon allows SYSTEM-level code execution on Domain Controllers. Immediate patching is required.

2026-06-04 00:16 UTC
Critical Windows Netlogon Bug CVE-2026-41089 Now Exploited in the Wild

web:windowsreport.com

Belgium's cybersecurity agency warns attackers are actively exploiting the critical Windows Netlogon vulnerability CVE - 2026 -41089.

2026-06-04 00:16 UTC
Windows Netlogon RCE exploited, domain controllers at risk (CVE-2026 ...

web:www.helpnetsecurity.com

CVE - 2026 -41089, a critical Windows Netlogon RCE flaw that allows remote code execution, is now actively exploited in the wild.

2026-06-04 00:16 UTC
Windows Netlogon 0-Click RCE Vulnerability Now Actively Exploited In ...

web:cybersecuritynews.com

The critical Windows Netlogon remote code execution (RCE) vulnerability tracked as CVE - 2026 -41089 is now under active exploitation in the wild, significantly raising the risk profile for unpatched Windows Server environments.

2026-06-19 02:27 UTC
Security Update Guide - Loading - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-06-19 02:27 UTC
CVE-2026-41089 Netlogon RCE: Why Windows Domain Controllers Must Patch ...

web:windowsforum.com

CVE - 2026 -41089 is a Microsoft-disclosed Windows Netlogon remote code execution vulnerability published in the Security Update Guide on May 12, 2026 , affecting the authentication plumbing Windows domains use to establish trusted communication between domain-joined machines and domain controllers...

2026-06-19 02:27 UTC
Microsoft patches two zero-day flaws in Defender - CSO Online

web:www.csoonline.com

Microsoft released emergency fixes for two zero-day vulnerabilities in the malware protection components of Microsoft Defender. The flaws allow local attackers to gain system-level privileges or ...

2026-06-19 02:27 UTC
CISA just added two Microsoft Defender flaws to the actively ... - MSN

web:www.msn.com

Every federal civilian agency running Microsoft Defender now faces a two-week countdown to fix two actively exploited security flaws. CISA added CVE - 2026 -41091 and CVE - 2026 -45498 to its Known ...

2026-06-19 02:27 UTC
Windows Netlogon CVE-2026-41089 exploited: Priority patch needed

web:www.notebookcheck.net

CVE - 2026 -41089, a critical Windows Netlogon flaw rated CVSS 9.8, is now actively exploited. Unpatched domain controllers face full SYSTEM-level compromise with no credentials needed.

2026-06-19 02:27 UTC
Microsoft Defender Actively Exploited Vulnerabilities - Secure ISS

web:www.secure-iss.com

Cybersecurity News - Microsoft Defender 0-Days Exploited Help Net Security - Microsoft Defender vulnerabilities CVE - 2026 -41091, CVE - 2026 -45498 If your organisation needs assistance assessing exposure, validating Microsoft Defender versions, or prioritising remediation , Secure ISS can help. Contact our SOC team on 1300 769 460 or email us.

2026-06-19 02:27 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-45891.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3_enet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb6a4c376d454b425555b1b0bda36e99f56ec307",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            },
            {
              "lessThan": "43015461662d41dcfb3bb95fadd8a2a42ad8eacf",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            },
            {
              "lessThan": "6dc10494cfe27b6f1e9adb7e293293ae39c50b7c",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            },
            {
              "lessThan": "d2c785733dfb853ea0b53984c75662a1af230a94",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            },
            {
              "lessThan": "fdbccddb7e7822016601829f95de4008e193f7bc",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            },
            {
              "lessThan": "c3659273860bed0c8e573b865e3769abc51225a8",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            },
            {
              "lessThan": "6d2f142b1e4b203387a92519d9d2e34752a79dbb",
              "status": "affected",
              "version": "907676b130711fd1f627824559e92259db2061d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3_enet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix double free issue for tx spare buffer\n\nIn hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure\nis created for rollback. However, the tx_spare pointer in the original\nring handle is incorrectly left pointing to the old backup memory.\n\nLater, if memory allocation fails in hns3_init_all_ring() during the setup,\nthe error path attempts to free all newly allocated rings. Since tx_spare\ncontains a stale (non-NULL) pointer from the backup, it is mistaken for\na newly allocated buffer and is erroneously freed, leading to a double-free\nof the backup memory.\n\nThe root cause is that the tx_spare field was not cleared after its value\nwas saved in tmp_rings, leaving a dangling pointer.\n\nFix this by setting tx_spare to NULL in the original ring structure\nwhen the creation of the new `tx_spare` fails. This ensures the\nerror cleanup path only frees genuinely newly allocated buffers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:02.306Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307"
        },
        {
          "url": "https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb"
        }
      ],
      "title": "net: hns3: fix double free issue for tx spare buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45891",
    "datePublished": "2026-05-27T12:17:02.306Z",
    "dateReserved": "2026-05-13T15:03:33.083Z",
    "dateUpdated": "2026-05-27T12:17:02.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}