CVE-2026-46181 Linux CVE debrief

Who should care

Organizations running Linux systems with Mellanox ConnectX-3 or earlier InfiniBand/Ethernet adapters utilizing RDMA Shared Receive Queues; cloud providers offering RDMA-enabled instances; HPC clusters using mlx4-based interconnects; kernel maintainers and distribution security teams tracking RDMA subsystem fixes

Technical summary

The mlx4_srq_event() function in the Linux kernel's RDMA/mlx4 driver incorrectly used RCU synchronization for accessing SRQ (Shared Receive Queue) structures. While the radix_tree lookup is RCU-safe, the mlx4_srq structure itself lacks RCU-managed freeing, and the code accessed the structure outside any RCU critical section. More critically, no mechanism prevented event delivery from racing with SRQ initialization, potentially dereferencing a partially initialized structure. The resolution replaces RCU with a spinlock for mutual exclusion, adds refcount_inc_not_zero() to detect and reject accesses to uninitialized objects, and reorders initialization to ensure refcount_set() follows complete SRQ setup. This eliminates the crash vector while maintaining correct reference counting for SRQ lifecycle management.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates containing the referenced commits when available from your Linux distribution
• For systems using Mellanox ConnectX-3 or earlier InfiniBand/Ethernet adapters with SRQ functionality, prioritize kernel patching
• Monitor NVD for CVSS scoring once analysis is complete
• Review kernel logs for any historical mlx4_srq-related crashes that may indicate prior exploitation attempts
• Consider disabling SRQ functionality on affected systems if patching is not immediately feasible and the feature is not required

Evidence notes

The vulnerability description indicates this was a code correctness issue identified during review (attributed to 'Sashiko') rather than an externally reported exploit. The fix involves three commits to stable kernel branches, suggesting backporting to multiple supported kernel versions. The CVSS score is not yet assigned (NVD status: Awaiting Analysis). The vendor identification has low confidence and requires review, though the source code references clearly indicate this is a Linux kernel issue affecting Mellanox mlx4 RDMA driver users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.