Linux Kernel EUVD-2026-27650

This affects the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically the Intel Ethernet RDMA (irdma) driver introduced to support re-registration of memory regions. The vulnerability is a use-after-free/double-free condition in the ib_umem (InfiniBand user memory) management code. When applications use the IB_MR_REREG_TRANS flag to change the translation (virtual-to-physical mapping) of a memory region, the irdma_rereg_mr_trans function releases the old umem structure via ib_umem_release() and allocates a new one. However, if allocation succeeds but a subsequent validation or setup step fails, the error path calls ib_umem_release() again without setting iwmr->region to NULL. When the failure propagates to userspace and the application correctly calls ibv_dereg_mr() to clean up, the deregistration path encounters the dangling pointer and attempts to free the already-freed memory. This is a classic double-free vulnerability (related to CWE-415, though not explicitly tagged), typically exploitable for denial of service and potentially for privilege escalation if an attacker can control heap layout. The affected CPE strings indicate broad impact across Linux kernel versions containing the RDMA/irdma driver code introduced in commit 5ac388db27c4.