CVE-2026-46112 (GCVE-0-2026-46112)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-08-05 12:29
VLAI
Title
RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Sashiko points out that hns_roce_qp_remove() requires the caller to hold locks. The error flow in hns_roce_create_qp_common() doesn't hold those locks for the error unwind so it risks corrupting memory. Grab the same locks the other two callers use.
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < 1f0a3aa8b569d010316b427238222c5d899f9618 (git)
Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < b6296ff2475fc95ee6ea1b528c4b385302808186 (git)
Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < fb4ae739811d467409bd07d0e36cfd4140f3d26a (git)
Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb (git)
Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < 1912f78798505dc9c637081bbddfbf1c22494c49 (git)
Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < 615d9d260c32bb678504ca96f29ae46f9d745155 (git)
Affected: e088a685eae94a0607b8f7b99949a0e14d748813 , < 0c99acbc8b6c6dd526ae475a48ee1897b61072fb (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f0a3aa8b569d010316b427238222c5d899f9618",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            },
            {
              "lessThan": "b6296ff2475fc95ee6ea1b528c4b385302808186",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            },
            {
              "lessThan": "fb4ae739811d467409bd07d0e36cfd4140f3d26a",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            },
            {
              "lessThan": "fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            },
            {
              "lessThan": "1912f78798505dc9c637081bbddfbf1c22494c49",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            },
            {
              "lessThan": "615d9d260c32bb678504ca96f29ae46f9d745155",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            },
            {
              "lessThan": "0c99acbc8b6c6dd526ae475a48ee1897b61072fb",
              "status": "affected",
              "version": "e088a685eae94a0607b8f7b99949a0e14d748813",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix unlocked call to hns_roce_qp_remove()\n\nSashiko points out that hns_roce_qp_remove() requires the caller to hold\nlocks.  The error flow in hns_roce_create_qp_common() doesn\u0027t hold those\nlocks for the error unwind so it risks corrupting memory.\n\nGrab the same locks the other two callers use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the local RDMA uverbs character device (ibv_create_qp), a control-plane operation; it cannot be triggered by a remote peer sending RDMA packets.\nAC:L - The attacker can reliably force the error-unwind path (e.g., a faulting ib_copy_to_udata output buffer) and controls both sides of the race by running concurrent QP create/destroy and CQ-poll operations on the same device/CQs.\nPR:L - Creating a QP requires access to the RDMA verbs device but no CAP/root; an unprivileged local user with RDMA access (common in HPC/cloud/container deployments) can reach the code.\nUI:N - The attacker triggers QP creation and the error path directly with no action required from any other user.\nS:U - Corruption stays within the kernel\u0027s own memory/security authority; no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Unlocked list_del causes linked-list corruption that can be leveraged into use-after-free and arbitrary kernel-memory disclosure; per guidance memory corruption exploitable for info leak is High.\nI:H - Racing list_del/list_add writes attacker-influenced pointer values into neighbor nodes, a memory-corruption write primitive that can be escalated to control-flow hijack; High.\nA:H - List corruption and the resulting use-after-free reliably oops/panic the kernel, a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:44.058Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f0a3aa8b569d010316b427238222c5d899f9618"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6296ff2475fc95ee6ea1b528c4b385302808186"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb4ae739811d467409bd07d0e36cfd4140f3d26a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1912f78798505dc9c637081bbddfbf1c22494c49"
        },
        {
          "url": "https://git.kernel.org/stable/c/615d9d260c32bb678504ca96f29ae46f9d745155"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c99acbc8b6c6dd526ae475a48ee1897b61072fb"
        }
      ],
      "title": "RDMA/hns: Fix unlocked call to hns_roce_qp_remove()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46112",
    "datePublished": "2026-05-28T09:35:20.879Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-08-05T12:29:44.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46112",
      "date": "2026-08-19",
      "epss": "0.001",
      "percentile": "0.00961"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:50:13.000Z",
      "cve": "CVE-2026-46112",
      "id": "msrc_CVE-2026-46112",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/hns: Fix unlocked call to hns_roce_qp_remove()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46112.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46112\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:26.660\",\"lastModified\":\"2026-06-24T18:25:40.057\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/hns: Fix unlocked call to hns_roce_qp_remove()\\n\\nSashiko points out that hns_roce_qp_remove() requires the caller to hold\\nlocks.  The error flow in hns_roce_create_qp_common() doesn\u0027t hold those\\nlocks for the error unwind so it risks corrupting memory.\\n\\nGrab the same locks the other two callers use.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/hns/hns_roce_qp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"1f0a3aa8b569d010316b427238222c5d899f9618\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"b6296ff2475fc95ee6ea1b528c4b385302808186\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"fb4ae739811d467409bd07d0e36cfd4140f3d26a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"1912f78798505dc9c637081bbddfbf1c22494c49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"615d9d260c32bb678504ca96f29ae46f9d745155\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e088a685eae94a0607b8f7b99949a0e14d748813\",\"lessThan\":\"0c99acbc8b6c6dd526ae475a48ee1897b61072fb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/hns/hns_roce_qp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"AF3A679E-2CF5-4AD0-B523-490CDE9711E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"5AFBE0EC-CCDF-4207-AE92-ABF958125CA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c99acbc8b6c6dd526ae475a48ee1897b61072fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1912f78798505dc9c637081bbddfbf1c22494c49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f0a3aa8b569d010316b427238222c5d899f9618\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/615d9d260c32bb678504ca96f29ae46f9d745155\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b6296ff2475fc95ee6ea1b528c4b385302808186\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb4ae739811d467409bd07d0e36cfd4140f3d26a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:18:29+00:00",
      "cve": "CVE-2026-46112",
      "id": "CVE-2026-46112",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/hns: Fix unlocked call to hns_roce_qp_remove()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46112.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-28T17:14:50Z",
      "cve": "CVE-2026-46112",
      "id": "CVE-2026-46112",
      "initial_release_date": "2026-05-29T01:17:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "616",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46112",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46112.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…