CVE-2026-45891
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's hns3 network driver, a double-free vulnerability exists for the tx spare buffer. The issue occurs because the tx_spare pointer in the original ring structure is incorrectly left pointing to old backup memory after a temporary copy is created. When memory allocation fails during ring initialization, the error path erroneously frees the same buffer twice.
Risk Assessment
Double-freeing memory can corrupt kernel memory management structures, leading to system instability, kernel panic, or potentially arbitrary code execution.
Recommendation
Apply the latest Linux kernel patch that sets the tx_spare pointer to NULL in the original ring structure when creation of the new spare buffer fails. This ensures the error cleanup path only frees genuinely newly allocated buffers.
Related vulnerabilities
- CVE-2026-53581Critical
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and write user-controlled data to any file.
- CVE-2026-85982Critical
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host, could insert script content that executes in an administrator's browser.
- CVE-2026-84869Critical
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
- CVE-2026-84197Critical
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are disabled for every wss:// connection, with no builder option, constructor argument, or environment variable to enable it. An attacker intercepting the connection can present an arbitrary certificate, complete the TLS handshake, read credentials sent in the Authorization header, and read, alter, or inject Ditto Protocol messages.
- CVE-2026-75746Critical
ColdFusion is affected by an SQL Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.
- CVE-2026-49883Critical
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure without additional execution privileges. User interaction is not needed.
- CVE-2026-48273Critical
ColdFusion is affected by an Eval Injection vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.
- CVE-2026-28659Critical
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege without additional execution privileges. User interaction is not needed.
- CVE-2026-19232Critical
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this. Exploitation does not require user interaction and the scope is changed.
- CVE-2026-82004Critical
Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure is created for rollback. However, the tx_spare pointer in the original ring handle is incorrectly left pointing to the old backup memory. Later, if memory allocation fails in hns3_init_all_ring() during the setup, the error path attempts to free all newly allocated rings. Since tx_spare contains a stale (non-NULL) pointer from the backup, it is mistaken for a newly allocated buffer and is erroneously freed, leading to a double-free of the backup memory. The root cause is that the tx_spare field was not cleared after its value was saved in tmp_rings, leaving a dangling pointer. Fix this by setting tx_spare to NULL in the original ring structure when the creation of the new `tx_spare` fails. This ensures the error cleanup path only frees genuinely newly allocated buffers.