PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46178 Linux CVE debrief

A resource leak vulnerability exists in the Linux kernel's RDMA/mlx4 driver. The mlx4_ib_create_srq() function fails to call mlx4_srq_free() during error unwind paths after mlx4_srq_alloc() has been called, leading to a resource leak. This affects systems using Mellanox ConnectX-3 InfiniBand/Ethernet adapters with the mlx4 driver. The vulnerability was resolved by adding the missing mlx4_srq_free() call in the error handling path.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux systems with Mellanox ConnectX-3 InfiniBand or Ethernet adapters using the mlx4 kernel driver, particularly those with high-throughput RDMA workloads that frequently create and destroy SRQs.

Technical summary

The mlx4_ib_create_srq() function in the Linux kernel's RDMA/mlx4 driver allocates an SRQ (Shared Receive Queue) resource using mlx4_srq_alloc(), but fails to free this resource via mlx4_srq_free() if an error occurs during subsequent initialization steps. This results in a resource leak that could lead to resource exhaustion over time. The fix adds the missing mlx4_srq_free() call to the error unwind path. The vulnerability affects systems with Mellanox ConnectX-3 adapters using the mlx4 driver.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2026-46178 when available from your Linux distribution
  • For systems using Mellanox ConnectX-3 (mlx4) adapters, monitor for kernel updates addressing this resource leak
  • Review system logs for SRQ (Shared Receive Queue) allocation failures that may indicate resource exhaustion
  • Consider upgrading to kernel versions containing the fix: 0dbd619716fb07b7de1acd64fec673ee6e1adde7 or equivalent stable backports

Evidence notes

The CVE description and source references confirm this is a resource leak fix in the RDMA/mlx4 driver. The fix adds a missing mlx4_srq_free() call during error unwind in mlx4_ib_create_srq(). Multiple stable kernel branches received backports of this fix.

Official resources

2026-05-28