CVE-2026-46112

Technical summary

CVE-2026-46112 is a race condition in the Linux kernel's HNS RDMA driver (drivers/infiniband/hw/hns/). The function hns_roce_qp_remove() modifies shared queue pair data structures and requires callers to hold specific locks for thread safety. In the error unwind path of hns_roce_create_qp_common(), this function is called without acquiring those locks, creating a window where concurrent access can lead to memory corruption. The two normal code paths that call hns_roce_qp_remove() correctly hold the required locks; the vulnerability is isolated to error handling.

Business impact

For organizations running Linux systems with HNS RDMA hardware (primarily Huawei/HNS-based InfiniBand deployments), this vulnerability poses a local privilege escalation and denial-of-service risk. An authenticated local user could trigger queue pair creation failures to exploit the race condition, potentially gaining kernel-level access or crashing RDMA services. Systems used for high-performance computing, cloud infrastructure with RDMA networking, or data center interconnect fabric are most exposed. The impact is limited to local attack surface—remote exploitation is not possible.

Affected systems

Linux kernel versions containing the vulnerable hns_roce_qp_remove() code path in the HNS RDMA driver. This affects systems using Huawei HNS or compatible RDMA hardware. Desktop and server systems without RDMA hardware or without the HNS driver are unaffected. Verify affected kernel versions and HNS driver versions against the official Linux kernel security advisory and your vendor's release notes.

Exploitability

Exploitation requires local system access (PR:L in CVSS) and standard user privileges. An attacker must be able to trigger queue pair creation operations that fail, forcing the vulnerable error path. While not trivial, queue pair creation is accessible to RDMA-aware applications running on the system. No special hardware configuration or user interaction is needed once execution begins. The vulnerability is not currently tracked in CISA's KEV catalog, suggesting active exploitation in the wild has not yet been confirmed, but the flaw is straightforward enough that exploitation tools could emerge quickly once awareness spreads.

Remediation

Apply Linux kernel patches that add proper lock acquisition in the hns_roce_create_qp_common() error unwinding path. The fix ensures the same locks held by other callers of hns_roce_qp_remove() are acquired before cleanup. Systems should update to patched kernel versions as provided by their distribution or the Linux kernel project. For systems where immediate patching is infeasible, restrict local access and disable RDMA services if not essential.

Patch guidance

Monitor Linux kernel security advisories and your distribution's update channels for patched versions addressing this CVE. The fix is a straightforward locking addition to error handling code and should be low-risk. Test patches in a staging environment before production deployment, particularly on systems with active RDMA workloads. Verify kernel version after patching using `uname -r` and confirm the HNS RDMA driver is updated.

Detection guidance

Monitor kernel logs for memory corruption warnings, NULL pointer dereferences, or crashes in the RDMA subsystem (look for HNS driver stack traces). Systems with verbose logging can watch for queue pair creation failures followed by data corruption indicators. Intrusion detection systems can flag repeated queue pair creation attempts by unprivileged users, though this is not proof of exploitation. Kernel ASAN (Address Sanitizer) or other memory debugging tools, if enabled, would highlight corruption attempts. Check system audit logs for failed RDMA operations correlated with privilege escalation or unexpected kernel panics.

Why prioritize this

This is a HIGH severity (7.8 CVSS) local privilege escalation affecting specialized RDMA infrastructure. Prioritize based on your environment: systems with HNS RDMA hardware in trusted but multi-tenant environments need urgent patching. Organizations using RDMA for HPC, cloud networking, or storage should patch within days to weeks. Systems without RDMA hardware can deprioritize. The lack of KEV listing and remote exploitability constraints it to targeted insider threats, but privilege escalation potential and the likelihood of future exploit tools make it serious.

Risk score, explained

CVSS 7.8 (HIGH) reflects high impact (integrity and availability compromise, privilege escalation) and local attack vector. The score is appropriate: memory corruption via unlocked code can crash systems or elevate privileges, but requires local access and valid user credentials. The straightforward nature of the bug (missing locks) and the specificity to HNS hardware prevent a critical score. Organizations with no RDMA exposure should treat this as medium risk; those with HNS infrastructure should treat it as high.

Frequently asked questions