The Linux kernel hns3 driver had a double-free vulnerability (CVE-2026-45891) in the hns3_set_ringparam() function. When setting ring parameters, a temporary copy of the ring structure is made for rollback purposes. However, the tx_spare pointer in the original ring structure was left pointing to old backup memory after the copy, and not cleared. If memory allocation fails later in hns3_init_all_ring(), the error cleanup path attempts to free all newly allocated buffers, including the stale tx_spare pointer, causing a double-free of the backup memory. The fix involves setting tx_spare to NULL in the original ring structure when allocation of a new tx_spare fails, ensuring only valid buffers are freed during cleanup.

This vulnerability can cause a double-free condition in kernel memory, which may lead to system instability, crashes, or potential escalation of privileges due to memory corruption. The CVSS vector indicates local attack complexity and privileges required, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been fixed in the Linux kernel source by clearing the tx_spare pointer on allocation failure. Users should monitor official Linux kernel advisories and apply updates when available to remediate this issue.