Description

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again. Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:17:59.850Z",
  "pubdate": "2026-08-15T13:17:59.850Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel within the rtase driver, specifically in the transmit path handled by rtase_start_xmit(). This flaw involves a double free condition of a multi-fragment socket buffer (skb) when a Direct Memory Access (DMA) mapping failure occurs for the head buffer. The vulnerability type is classified as a double free memory management error, leading to severe memory corruption risks within the kernel heap. Affected systems include those utilizing the Linux kernel with the rtase network driver. The risk implications encompass potential kernel crashes, denial of service, and theoretical arbitrary code execution due to heap metadata corruption. Exploitation of this vulnerability requires local execution context or network packet handling triggers that induce DMA mapping failures during high-load or low-resource conditions. Attacker capabilities are generally constrained to causing system instability unless specific heap grooming conditions are met. Remediation requires applying the official kernel patch that corrects the error handling control flow to prevent redundant socket buffer deallocation.",
  "technicalDetails": "The vulnerability resides in the rtase_start_xmit() function within the Linux kernel network driver for rtase. During the packet transmission process, the driver attempts to map the head buffer using DMA after successfully mapping all individual fragments via rtase_xmit_frags(). If the subsequent head buffer DMA mapping operation fails, the driver initiates an error handling sequence to clean up resources and prevent memory leaks. In the flawed implementation, the error handling path invokes rtase_tx_clear_range() to clear the fragment descriptors. This function explicitly frees the associated socket buffer (skb) through the last-fragment slot and increments the tx_dropped counter. However, the execution flow then falls through to the common error label located further down in the function. This common error label unconditionally attempts to free the exact same skb a second time and increments the drop counter again. This dual deallocation of the same memory address constitutes a classic double free vulnerability in kernel space. When the kernel memory allocator processes the second deallocation of the same skb pointer, it corrupts the internal heap management structures, such as free lists or slab allocator metadata. The attack flow involves triggering a condition where the head buffer DMA map operation fails immediately after successful fragment mapping. This can potentially be induced by resource exhaustion or injected network traffic payloads designed to stress kernel memory and DMA allocation subsystems. The vulnerable component is the error handling control flow in the rtase driver transmit routine. Authentication and privilege requirements depend on the kernel subsystem interface, typically requiring root or CAP_NET_ADMIN privileges to configure network interfaces or load conditions, though the vulnerability itself manifests automatically upon driver error states. Post-exploitation impact is characterized by kernel panics, memory corruption, and system instability, effectively resulting in a localized denial of service condition."
}