Vulnerability-Lookup

CVE-2026-46145 (GCVE-0-2026-46145)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:36 – Updated: 2026-09-09 12:04

Title

RDMA/mana: Validate rx_hash_key_len

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the memcpy cannot overflow.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux mitre root

References

15 references

URL	Tags
https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f…
https://git.kernel.org/stable/c/11c1431d641e0e4e0…
https://git.kernel.org/stable/c/012796f9541fcd0c1…
https://git.kernel.org/stable/c/7d94f155f354b961c…
https://git.kernel.org/stable/c/6dd2d4ad9c8429523…
https://access.redhat.com/security/cve/CVE-2026-46145	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2482581	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:64767	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30129	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27353	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27354	vendor-advisoryx_refsource_REDHAT

Impacted products

12 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 0266a177631d4c6b963b5b12dd986a8c5abdbf06 , < 7d7c9f0fcd19c4d2f0164347c58d49cafa961b72 (git) Affected: 0266a177631d4c6b963b5b12dd986a8c5abdbf06 , < 11c1431d641e0e4e0529e96957995820600c7287 (git) Affected: 0266a177631d4c6b963b5b12dd986a8c5abdbf06 , < 012796f9541fcd0c1fa8ae4da7eb4d83931ef838 (git) Affected: 0266a177631d4c6b963b5b12dd986a8c5abdbf06 , < 7d94f155f354b961c598f71bafa804dceded513f (git) Affected: 0266a177631d4c6b963b5b12dd986a8c5abdbf06 , < 6dd2d4ad9c8429523b1c220c5132bd551c006425 (git)	guessed
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)	guessed
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.28.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.103.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.rt7.477.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.17.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.149.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.138.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.28.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.103.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.rt7.477.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.17.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.149.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.138.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-28T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s RDMA/mana component. A local user could exploit this vulnerability by providing an invalid `rx_hash_key_len` value through a user-space API (uAPI) structure. This invalid value is then used in a `memcpy` operation without proper bounds checking, allowing the user to write beyond intended memory boundaries. This can lead to kernel memory corruption, potentially resulting in privilege escalation or a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T12:04:46.296Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46145"
          },
          {
            "name": "RHBZ#2482581",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482581"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46145.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:64767"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30129"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62568"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27353"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27354"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:64767: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30129: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62568: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27353: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27354: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: RDMA/mana: Validate rx_hash_key_len",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mana/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d7c9f0fcd19c4d2f0164347c58d49cafa961b72",
              "status": "affected",
              "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
              "versionType": "git"
            },
            {
              "lessThan": "11c1431d641e0e4e0529e96957995820600c7287",
              "status": "affected",
              "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
              "versionType": "git"
            },
            {
              "lessThan": "012796f9541fcd0c1fa8ae4da7eb4d83931ef838",
              "status": "affected",
              "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
              "versionType": "git"
            },
            {
              "lessThan": "7d94f155f354b961c598f71bafa804dceded513f",
              "status": "affected",
              "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
              "versionType": "git"
            },
            {
              "lessThan": "6dd2d4ad9c8429523b1c220c5132bd551c006425",
              "status": "affected",
              "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mana/qp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana: Validate rx_hash_key_len\n\nSashiko points out that rx_hash_key_len comes from a uAPI structure and is\nblindly passed to memcpy, allowing the userspace to trash kernel\nmemory. Bounds check it so the memcpy cannot overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker\u0027s control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker\u0027s own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel\u0027s own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:01.405Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72"
        },
        {
          "url": "https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287"
        },
        {
          "url": "https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dd2d4ad9c8429523b1c220c5132bd551c006425"
        }
      ],
      "title": "RDMA/mana: Validate rx_hash_key_len",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46145",
    "datePublished": "2026-05-28T09:36:01.805Z",
    "dateReserved": "2026-05-13T15:03:33.100Z",
    "dateUpdated": "2026-09-09T12:04:46.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46145",
      "date": "2026-09-19",
      "epss": "0.00147",
      "percentile": "0.04341"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:41:59.000Z",
      "cve": "CVE-2026-46145",
      "id": "msrc_CVE-2026-46145",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/mana: Validate rx_hash_key_len",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46145.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/mana/qp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7d7c9f0fcd19c4d2f0164347c58d49cafa961b72",
                    "status": "affected",
                    "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "11c1431d641e0e4e0529e96957995820600c7287",
                    "status": "affected",
                    "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "012796f9541fcd0c1fa8ae4da7eb4d83931ef838",
                    "status": "affected",
                    "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d94f155f354b961c598f71bafa804dceded513f",
                    "status": "affected",
                    "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6dd2d4ad9c8429523b1c220c5132bd551c006425",
                    "status": "affected",
                    "version": "0266a177631d4c6b963b5b12dd986a8c5abdbf06",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/mana/qp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.141",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.88",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:10.2"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 10",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:6.12.0-211.28.1.el10_2",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux_eus:10.0"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:6.12.0-55.103.1.el10_0",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:enterprise_linux:8::nfv"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:4.18.0-553.136.1.rt7.477.el8_10",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:8"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:4.18.0-553.136.1.el8_10",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:enterprise_linux:9",
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:5.14.0-687.17.1.el9_8",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:rhel_e4s:9.4"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:5.14.0-427.149.1.el9_4",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:rhel_eus:9.6"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:5.14.0-570.138.1.el9_6",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:6"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7",
                    "versionEndExcluding": "6.6.141",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4",
                    "versionEndExcluding": "6.12.88",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                    "versionEndExcluding": "6.18.30",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                    "versionEndExcluding": "7.0.7",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana: Validate rx_hash_key_len\n\nSashiko points out that rx_hash_key_len comes from a uAPI structure and is\nblindly passed to memcpy, allowing the userspace to trash kernel\nmemory. Bounds check it so the memcpy cannot overflow."
          }
        ],
        "id": "CVE-2026-46145",
        "lastModified": "2026-09-09T13:20:16.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-28T10:16:30.110",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6dd2d4ad9c8429523b1c220c5132bd551c006425"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513f"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:27353"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:27354"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:27789"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:30129"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:62568"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:64767"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:65712"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/security/cve/CVE-2026-46145"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482581"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46145.json"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-09T01:36:05+00:00",
      "cve": "CVE-2026-46145",
      "id": "CVE-2026-46145",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:fixed": "1607",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/mana: Validate rx_hash_key_len",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46145.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:54:27Z",
      "cve": "CVE-2026-46145",
      "id": "CVE-2026-46145",
      "initial_release_date": "2026-05-29T01:16:19Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "402",
      "product_status:known_not_affected": "221",
      "product_status:recommended": "549",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46145",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46145.json",
      "version": "20"
    }
  }
}

OPENSUSE-SU-2026:10954-1

Vulnerability from csaf_opensuse - Published: 2026-06-04 00:00 - Updated: 2026-09-17 17:08

Summary

kernel-devel-7.0.11-1.1 on GA media

Severity

Moderate

Scope

274 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 16 products

Open the full advisory

OPENSUSE-SU-2026:21555-1

Vulnerability from csaf_opensuse - Published: 2026-08-12 01:09 - Updated: 2026-09-17 17:41

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 136 products

Open the full advisory

RHSA-2026:27353

Vulnerability from csaf_opensuse - Published: 2026-06-19 00:00 - Updated: 2026-09-16 18:31

Summary

security update for kernel

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 20 products

Open the full advisory

RHSA-2026:27789

Vulnerability from csaf_opensuse - Published: 2026-06-22 00:00 - Updated: 2026-09-16 18:31

Summary

security update for kernel

Severity

Important

Scope

17 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 41 products

Open the full advisory

RHSA-2026:30129

Vulnerability from csaf_opensuse - Published: 2026-06-25 00:00 - Updated: 2026-09-16 18:32

Summary

security update for kernel

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 42 products

Open the full advisory

RHSA-2026:27354

Vulnerability from csaf_redhat - Published: 2026-06-19 16:39 - Updated: 2026-09-14 18:26

Summary

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

A flaw was found in the Linux kernel's RDMA/mana component. A local user could exploit this vulnerability by providing an invalid `rx_hash_key_len` value through a user-space API (uAPI) structure. This invalid value is then used in a `memcpy` operation without proper bounds checking, allowing the user to write beyond intended memory boundaries. This can lead to kernel memory corruption, potentially resulting in privilege escalation or a denial of service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 30 products

https://access.redhat.com/errata/RHSA-2026:27354

Open the full advisory

RHSA-2026:62568

Vulnerability from csaf_redhat - Published: 2026-09-02 13:05 - Updated: 2026-09-17 12:42

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 305 products

https://access.redhat.com/errata/RHSA-2026:62568

Open the full advisory

RHSA-2026:64767

Vulnerability from csaf_redhat - Published: 2026-09-08 01:25 - Updated: 2026-09-16 12:07

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 307 products

https://access.redhat.com/errata/RHSA-2026:64767

Open the full advisory

RHSA-2026:65712

Vulnerability from csaf_redhat - Published: 2026-09-09 01:30 - Updated: 2026-09-17 15:01

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2026-46145.

CVE-2026-46145

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 233 products

https://access.redhat.com/errata/RHSA-2026:65712

Open the full advisory

RLSA-2026:27353 (CVE-2026-31419)

Vulnerability from osv_rocky – Published: 2026-06-24 12:00 – Updated: 2026-07-08 12:07 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

Rocky Linux8 RT kernel panic in replenish_dl_entity() caused by stale DEADLINE PI state during rt_mutex de-boosting (JIRA:Rocky Linux-178520)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:27353	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2457829	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2460619	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2464449	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467215	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2479492	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2481980	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482581	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482654	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.136.1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)\n\n* kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)\n\n* kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)\n\n* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)\n\n* kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)\n\n* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)\n\n* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)\n\n* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)\n\nBug Fix(es) and Enhancement(s):\n\n* Rocky Linux8 RT kernel panic in replenish_dl_entity() caused by stale DEADLINE PI state during rt_mutex de-boosting (JIRA:Rocky Linux-178520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:27353",
  "modified": "2026-07-08T12:07:57.737478Z",
  "published": "2026-06-24T12:00:44.020996Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:27353"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457829"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460619"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464449"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467215"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479492"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481980"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482581"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482654"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-31419",
    "CVE-2026-31488",
    "CVE-2026-43056",
    "CVE-2026-43279",
    "CVE-2026-46090",
    "CVE-2026-46135",
    "CVE-2026-46145",
    "CVE-2026-46331"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-46145 (GCVE-0-2026-46145)

RLSA-2026:27353 (CVE-2026-31419)

Tags

Sightings

Nomenclature

Related by attack behaviour