The Linux kernel's RDMA rxe driver contained a double free vulnerability in the function rxe_srq_from_init. Specifically, the queue pointer 'q' was assigned to 'srq->rq.queue' before a copy_to_user() call. If copy_to_user() failed, the queue was freed but the pointer was left dangling, leading to a second free when the caller cleaned up. This could cause memory corruption or kernel instability. The fix moves the pointer assignment until after the copy_to_user() call succeeds. Red Hat's advisory confirms the issue and provides a patched kernel update for RHEL 9.6 Extended Update Support.

Successful exploitation of this vulnerability could lead to kernel memory corruption due to a double free condition, potentially causing system crashes or allowing an attacker with limited privileges to escalate their privileges or disrupt system stability. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, with high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update for Red Hat Enterprise Linux 9.6 Extended Update Support that fixes this vulnerability. Users should apply the kernel update provided in RHSA-2026:34094 and reboot their systems to ensure the fix takes effect. No additional mitigation steps are required beyond applying the official patch and rebooting.