Bug 2482594 (CVE-2026-46176)

Summary:	CVE-2026-46176 kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the `mlx5_ib_dev_res_srq_init()` function, specifically when `ib_create_srq()` fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial of service, or potentially arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-28 11:04:56 UTC

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When
ib_create_srq() fails for s1, the error branch destroys s0 but falls
through and unconditionally assigns the freed s0 and the ERR_PTR s1 to
devr->s0 and devr->s1.

This leads to several problems: the lock-free fast path checks
"if (devr->s1) return 0;" and treats the ERR_PTR as already initialised;
users in mlx5_ib_create_qp() dereference the freed SRQ or ERR_PTR via
to_msrq(devr->s0)->msrq.srqn; and mlx5_ib_dev_res_cleanup() dereferences
the ERR_PTR and double-frees s0 on teardown.

Fix by adding the same `goto unlock` in the s1 failure path.

Comment 1 Keith Grant 2026-05-28 14:48:07 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052828-CVE-2026-46176-a4db@gregkh/T

Comment 5 Rohit Keshri 2026-06-22 07:51:02 UTC

Exploitation Scenarios

  1. Use-After-Free Exploitation:
    - Attacker triggers SRQ creation failure for s1
    - Freed s0 memory is reallocated for attacker-controlled data
    - Subsequent mlx5_ib_create_qp() call dereferences attacker-controlled memory
    - Potential for arbitrary code execution or privilege escalation
  2. Double-Free Exploitation:
    - During teardown, mlx5_ib_dev_res_cleanup() attempts to free already-freed s0
    - Can lead to heap corruption
    - Exploitable for denial of service or memory corruption attacks
  3. Denial of Service:
    - Simpler attack: repeatedly trigger the vulnerability to crash the kernel
    - No special exploitation techniques required
    - System becomes unavailable

Comment 6 errata-xmlrpc 2026-06-29 04:56:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:30848 https://access.redhat.com/errata/RHSA-2026:30848

Comment 7 errata-xmlrpc 2026-06-29 19:24:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:33215 https://access.redhat.com/errata/RHSA-2026:33215

Comment 8 errata-xmlrpc 2026-06-30 19:05:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:33685 https://access.redhat.com/errata/RHSA-2026:33685

Comment 9 errata-xmlrpc 2026-07-01 08:59:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:34094 https://access.redhat.com/errata/RHSA-2026:34094

Comment 10 Jon Orris 2026-10-12 19:09:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:81452 https://access.redhat.com/errata/RHSA-2026:81452

Comment 11 Jon Orris 2026-10-12 19:09:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:81451 https://access.redhat.com/errata/RHSA-2026:81451

Comment 12 Jon Orris 2026-10-13 15:39:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:82326 https://access.redhat.com/errata/RHSA-2026:82326