PatchSiren cyber security CVE debrief

CVE-2026-46176 Linux CVE debrief

A logic error in the Linux kernel's RDMA/mlx5 driver allows use-after-free and NULL/ERR_PTR dereference when SRQ initialization fails. The vulnerability exists in mlx5_ib_dev_res_srq_init(), which allocates two shared receive queues (s0 and s1). When ib_create_srq() fails for s1, the error path destroys s0 but falls through to unconditionally assign both the freed s0 and the error-valued s1 to device resource pointers. This causes three distinct failure modes: subsequent initialization attempts treat the ERR_PTR as already initialized due to a lock-free fast-path check; callers in mlx5_ib_create_qp() dereference the freed or error pointer to access SRQ numbers; and cleanup in mlx5_ib_dev_res_cleanup() dereferences the ERR_PTR and double-frees s0. The fix adds proper error flow control to prevent the fall-through assignment.

Vendor: Linux
Product: Unknown
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-07-15
Advisory published: 2026-05-28
Advisory updated: 2026-07-15

Who should care

Organizations running Linux systems with Mellanox ConnectX InfiniBand/RDMA adapters; cloud providers offering RDMA-enabled compute instances; HPC cluster administrators; kernel maintainers and distribution security teams

Technical summary

The mlx5_ib_dev_res_srq_init() function in drivers/infiniband/hw/mlx5/devx.c allocates two SRQs for device resource management. The function uses a lock-free fast path that checks devr->s1 to skip re-initialization. In the error path where s1 allocation fails after s0 succeeds, the code destroys s0 via ib_destroy_srq() but lacks a goto statement to exit the critical section. Execution falls through to assignments of devr->s0 = s0 and devr->s1 = s1, storing a dangling pointer and an error pointer respectively. This pollutes device state: the fast-path check devr->s1 != NULL passes (ERR_PTR is non-NULL), causing early return on retry; mlx5_ib_create_qp() dereferences to_msrq(devr->s0)->msrq.srqn triggering use-after-free or invalid access; mlx5_ib_dev_res_cleanup() dereferences the ERR_PTR and calls ib_destroy_srq() on the already-freed s0. The fix inserts 'goto unlock' after ib_destroy_srq(s0) in the s1 failure path, ensuring consistent error handling.

Defensive priority

high

Recommended defensive actions

Apply kernel patches from stable branches when available
Monitor distribution security advisories for backported fixes
Review systems using Mellanox ConnectX RDMA adapters for kernel update scheduling
Validate SRQ initialization error handling in custom RDMA/mlx5 driver modifications

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry published 2026-05-28. Kernel commit references confirm the affected code path and resolution. No CVSS score or severity rating available at time of publication.

Sources and references

Verified primary and authoritative sources

CVE-2026-46176 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46176

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46176 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46176

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/6fd93142dd1d09000c3750af08270f5792523fe9

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/a13c2ac4d480b734342c6fbf8249fc48afd675f3

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/b087913ae88256df66620f7ba0a9776716aeef7e

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/bc2cf5935b4665172235341163315905197ae91d

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/c488df06bd552bb8b6e14fa0cfd5ad986c6e9525

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.