CVE-2026-46178 Linux CVE debrief

Who should care

Organizations running Linux systems with Mellanox ConnectX-3 InfiniBand or Ethernet adapters using the mlx4 kernel driver, particularly those with high-throughput RDMA workloads that frequently create and destroy SRQs.

Technical summary

The mlx4_ib_create_srq() function in the Linux kernel's RDMA/mlx4 driver allocates an SRQ (Shared Receive Queue) resource using mlx4_srq_alloc(), but fails to free this resource via mlx4_srq_free() if an error occurs during subsequent initialization steps. This results in a resource leak that could lead to resource exhaustion over time. The fix adds the missing mlx4_srq_free() call to the error unwind path. The vulnerability affects systems with Mellanox ConnectX-3 adapters using the mlx4 driver.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates containing the fix for CVE-2026-46178 when available from your Linux distribution
• For systems using Mellanox ConnectX-3 (mlx4) adapters, monitor for kernel updates addressing this resource leak
• Review system logs for SRQ (Shared Receive Queue) allocation failures that may indicate resource exhaustion
• Consider upgrading to kernel versions containing the fix: 0dbd619716fb07b7de1acd64fec673ee6e1adde7 or equivalent stable backports

Evidence notes

The CVE description and source references confirm this is a resource leak fix in the RDMA/mlx4 driver. The fix adds a missing mlx4_srq_free() call during error unwind in mlx4_ib_create_srq(). Multiple stable kernel branches received backports of this fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.