PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46127 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's RDMA/ocrdma driver. The function `ocrdma_copy_pd_uresp()` in the OCRDMA (Oracle Cloud RDMA) driver references `pd->uctx` in error handling paths before it has been initialized, leading to a kernel crash when error conditions occur. The fix ensures that the valid `uctx` pointer available earlier in the function is used instead of the uninitialized `pd->uctx` field. This is a local denial-of-service condition affecting systems with OCRDMA hardware and the corresponding kernel driver loaded.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-24
Advisory published
2026-05-28
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with Oracle Cloud RDMA (OCRDMA) hardware and the ocrdma kernel driver loaded should prioritize this update. Cloud providers and enterprises using RDMA over Converged Ethernet (RoCE) infrastructure with Oracle hardware are particularly affected.

Technical summary

The OCRDMA (Oracle Cloud RDMA) driver in the Linux kernel contains a NULL pointer dereference vulnerability in the `ocrdma_copy_pd_uresp()` function. The issue occurs because `pd->uctx` is referenced in error handling code paths before it has been initialized. When an error condition triggers these paths, the kernel attempts to dereference a NULL pointer, resulting in a crash. The vulnerability is local in nature, requiring the ability to interact with the RDMA subsystem. The fix modifies the error handling to use the valid `uctx` pointer that is available earlier in the function execution rather than the uninitialized structure member.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing CVE-2026-46127
  • If OCRDMA hardware is not required, consider disabling the ocrdma kernel module as a temporary risk reduction measure
  • Review system logs for unexpected kernel panics or crashes that may indicate exploitation attempts

Evidence notes

Vulnerability description confirms NULL pointer dereference in error path of `ocrdma_copy_pd_uresp()`. Multiple stable kernel commits provided indicate backports to affected versions. No CVSS score assigned by NVD at time of disclosure; status is 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46127 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46127

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46127 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46127

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/34fbf48cf3b410d2a6e8c586fa952a36331ca5ba

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/75fc130664ae324e7b2f9ad3630e0f175e9ca6c8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8832626a483439e207734e027afff322ccdf726e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e01a957561f663d3b68d2fd233a4502e3367efcd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ec44c00a4fe1327efa35083f98b39c01cb535a51

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.