CVE-2026-46176: Linux RDMA mlx5 Use-After-Free in SRQ Initialization

Technical summary

CVE-2026-46176 is a control-flow and resource management bug in mlx5_ib_dev_res_srq_init() within the RDMA/mlx5 driver. The function attempts to allocate two SRQs (s0 and s1). On ib_create_srq() failure for s1, the error handler destroys s0 but fails to return early, instead falling through and assigning both the freed s0 pointer and an ERR_PTR encoded error to devr->s0 and devr->s1. This violates the invariant that valid pointers should exist or the fields should remain uninitialized. The fastpath check "if (devr->s1) return 0" then misinterprets the ERR_PTR as successful initialization. Later, mlx5_ib_create_qp() dereferences these invalid pointers via to_msrq() macros, and mlx5_ib_dev_res_cleanup() performs double-free and ERR_PTR dereference on teardown. The fix adds a goto unlock statement in the s1 failure branch to match the s0 failure path semantics.

Business impact

Systems running affected Linux kernel versions with RDMA/Mellanox adapters face elevated risk of kernel panic, data corruption, and privilege escalation. A local attacker with sufficient privileges to trigger QP creation can exploit the use-after-free to corrupt kernel memory or achieve code execution within the kernel context. This is particularly concerning in shared hosting, HPC clusters, and cloud environments where RDMA is used for high-speed interconnect. Unplanned kernel crashes or panics disrupt workloads and services relying on RDMA communication.

Affected systems

The vulnerability affects Linux kernel versions containing the vulnerable mlx5_ib_dev_res_srq_init() function in the RDMA subsystem. Impact is limited to systems with Mellanox InfiniBand or RoCE adapters and RDMA kernel modules compiled and loaded. Systems without these adapters or without CONFIG_INFINIBAND_MLX5 enabled are not affected. Container and VM environments using RDMA pass-through are at risk if running vulnerable kernel versions.

Exploitability

Exploitation requires local access and sufficient privileges (PR:L in the CVSS vector) to invoke RDMA operations that trigger QP initialization with SRQ allocation. While not remotely exploitable, the low complexity and lack of user interaction requirements make it practical for local attackers to trigger. The vulnerability is triggered through standard RDMA API calls, not requiring specialized knowledge. No evidence of active exploitation in the wild has been disclosed, but the ease of local triggering warrants timely patching.

Remediation

Apply kernel updates from your Linux distribution that include the fix for CVE-2026-46176. The remedy is a minimal code change adding proper error-path control flow (goto unlock) to prevent the fall-through assignment of invalid pointers. Verify against vendor advisories for specific patch versions and kernel branch availability. Until patching is possible, restrict RDMA operations to trusted users and consider disabling RDMA modules if not operationally required.

Patch guidance

Obtain updates from your Linux distribution (Red Hat, Canonical, SUSE, etc.) that backport the fix to supported kernel series. Check kernel release notes and security advisories for version numbers incorporating this fix. Verify the commit message or patch content references mlx5_ib_dev_res_srq_init() error-path correction before applying. Testing on non-production RDMA infrastructure is recommended prior to production deployment to validate workload compatibility.

Detection guidance

Monitor for kernel oops or panic messages related to mlx5_ib or RDMA subsystems, particularly those involving use-after-free or NULL pointer dereference in mlx5_ib_create_qp() or mlx5_ib_dev_res_cleanup(). Enable CONFIG_DEBUG_PAGEALLOC and KASAN (Kernel Address Sanitizer) in development/test kernels to catch memory corruption early. Track RDMA QP creation and SRQ allocation patterns; repeated failures or crashes during these operations may indicate exploitation attempts or triggering of this bug.

Why prioritize this

The combination of HIGH CVSS score (7.8), local privilege requirement, and kernel memory corruption potential warrants priority patching for systems using RDMA. The use-after-free and double-free conditions can lead to privilege escalation and denial of service. While not actively exploited according to KEV data, the straightforward nature of triggering and the critical role of RDMA in infrastructure justify expedited deployment in affected environments.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (systems require local access); Attack Complexity Low (standard RDMA APIs trigger the bug); Privileges Required Low (attacker needs some elevated capability); User Interaction None (automatic upon triggering); Scope Unchanged (impact confined to affected system); Confidentiality High (memory corruption can leak kernel data); Integrity High (memory corruption enables arbitrary kernel writes); Availability High (kernel panic from use-after-free). The score does not account for low prevalence of RDMA deployment, which may lower real-world risk in some environments.

Frequently asked questions