PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46112 Linux CVE debrief

A race condition vulnerability exists in the Linux kernel's RDMA/hns driver where hns_roce_qp_remove() is called without holding required locks during error handling in hns_roce_create_qp_common(). This unlocked access risks memory corruption during queue pair creation failure paths. The fix ensures proper lock acquisition matching other callers' patterns.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-24
Advisory published
2026-05-28
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with RDMA/hns (Hisilicon Network Subsystem) hardware, particularly those utilizing InfiniBand or RDMA over Converged Ethernet (RoCE) on affected platforms.

Technical summary

The hns_roce_create_qp_common() function in the Linux kernel's RDMA/hns driver contains an error handling path that calls hns_roce_qp_remove() without acquiring the locks required by that function's contract. Other callers of hns_roce_qp_remove() properly hold these locks. The missing synchronization during error unwind creates a race condition that can corrupt memory structures. The resolution adds appropriate lock acquisition to the error path, aligning it with the locking discipline used elsewhere in the driver.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from distribution maintainers
  • Monitor RDMA/hns driver operation for stability issues on affected systems prior to patching
  • Review local kernel build configurations for hns_roce driver usage

Evidence notes

CVE description confirms unlocked call to hns_roce_qp_remove() in error flow; kernel commit references indicate stable branch backports. No CVSS score assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46112 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46112

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46112 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46112

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0c99acbc8b6c6dd526ae475a48ee1897b61072fb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1912f78798505dc9c637081bbddfbf1c22494c49

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/615d9d260c32bb678504ca96f29ae46f9d745155

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fb4ae739811d467409bd07d0e36cfd4140f3d26a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.