CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix error path fall-through in mlx5ibdevressrqinit()
mlx5ibdevressrqinit() allocates two SRQs, s0 and s1. When ibcreatesrq() fails for s1, the error branch destroys s0 but falls through and unconditionally assigns the freed s0 and the ERRPTR s1 to devr->s0 and devr->s1.
This leads to several problems: the lock-free fast path checks "if (devr->s1) return 0;" and treats the ERRPTR as already initialised; users in mlx5ibcreateqp() dereference the freed SRQ or ERRPTR via tomsrq(devr->s0)->msrq.srqn; and mlx5ibdevrescleanup() dereferences the ERRPTR and double-frees s0 on teardown.
Fix by adding the same goto unlock in the s1 failure path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernel RDMA mlx5 (mlx5_ib_dev_res_srq_init)to a version that resolves this vulnerability.Patch RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46176?
The severity of CVE-2026-46176 is high with a score of 7.8.
How do I fix CVE-2026-46176?
To fix CVE-2026-46176, update to the patched version of the Linux kernel where the vulnerability is resolved.
What systems are affected by CVE-2026-46176?
CVE-2026-46176 affects systems running the Linux Foundation Linux Kernel.
What does CVE-2026-46176 impact in the Linux kernel?
CVE-2026-46176 impacts the RDMA/mlx5 driver and the initialization of shared receive queues.
What are the potential consequences of CVE-2026-46176?
The consequences of CVE-2026-46176 include potential resource leaks and instability during SRQ initialization in RDMA environments.