CVE-2026-46112

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel RDMA/hns Driver

Publication date: 2026-05-28

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Sashiko points out that hns_roce_qp_remove() requires the caller to hold locks. The error flow in hns_roce_create_qp_common() doesn't hold those locks for the error unwind so it risks corrupting memory. Grab the same locks the other two callers use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-24

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46112

EUVD

EUVD-2026-32871

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 4.17 (inc) to 5.15.209 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's RDMA/hns component. Specifically, the function hns_roce_qp_remove() requires the caller to hold certain locks to operate safely. However, in the error handling flow of the function hns_roce_create_qp_common(), these locks were not held during an error unwind, which could lead to memory corruption.

The fix involved ensuring that the same locks used by other callers of hns_roce_qp_remove() are also acquired in this error path to prevent unsafe memory operations.

Impact Analysis

This vulnerability can lead to memory corruption within the Linux kernel's RDMA/hns subsystem. Memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.

Mitigation Strategies

The vulnerability in the Linux kernel related to RDMA/hns and the unlocked call to hns_roce_qp_remove() has been resolved by ensuring the proper locks are held during error handling.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-46112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70