A vulnerability in the Linux kernel's RDMA mlx5 driver (mlx5_ib_dev_res_srq_init function) causes error path fall-through when allocating shared… (CVE-2026-46176)
A vulnerability in the Linux kernel's RDMA mlx5 driver (mlx5_ib_dev_res_srq_init function) causes error path fall-through when allocating shared receive queues (SRQs). This leads to use-after-free and double-free conditions, as well as dereferencing of invalid pointers. The issue has been fixed by correcting the error handling path to prevent these unsafe operations. This vulnerability has a high severity rating and affects specific Linux kernel versions used in Red Hat Enterprise Linux 9 and 10. Updates addressing this issue are available and should be applied with a system reboot.
AI Analysis
Technical Summary
The Linux kernel vulnerability (CVE-2026-46176) in the RDMA mlx5 driver occurs in the mlx5_ib_dev_res_srq_init() function, which allocates two SRQs (s0 and s1). If the allocation of s1 fails, the error handling code incorrectly falls through, assigning freed and error pointers to device resources. This causes the lock-free fast path to misinterpret an ERR_PTR as initialized, and leads to use-after-free and double-free conditions during subsequent operations. The flaw is fixed by adding a proper error handling jump to avoid fall-through. This vulnerability is tracked under CWE-825 (use-after-free).
Potential Impact
Exploitation of this vulnerability can lead to kernel memory corruption due to use-after-free and double-free conditions, potentially causing system instability, crashes, or privilege escalation. The CVSS v3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported. The issue affects Linux kernel versions used in Red Hat Enterprise Linux 9 and 10 distributions.
Mitigation Recommendations
A vendor-provided official fix is available as part of Red Hat Enterprise Linux kernel updates (e.g., kernel-5.14.0-687.19.1.el9_8 for RHEL 9 and kernel-6.12.0-55.84.1.el10_0 for RHEL 10). Systems should be updated promptly using the vendor's recommended procedures and rebooted to apply the kernel update. Refer to Red Hat advisories RHSA-2026:30848 and RHSA-2026:33215 for detailed instructions. No additional mitigations are indicated by the vendor advisory.
A vulnerability in the Linux kernel's RDMA mlx5 driver (mlx5_ib_dev_res_srq_init function) causes error path fall-through when allocating shared… (CVE-2026-46176)
Description
A vulnerability in the Linux kernel's RDMA mlx5 driver (mlx5_ib_dev_res_srq_init function) causes error path fall-through when allocating shared receive queues (SRQs). This leads to use-after-free and double-free conditions, as well as dereferencing of invalid pointers. The issue has been fixed by correcting the error handling path to prevent these unsafe operations. This vulnerability has a high severity rating and affects specific Linux kernel versions used in Red Hat Enterprise Linux 9 and 10. Updates addressing this issue are available and should be applied with a system reboot.
CVSS v3.1
Score 7.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability (CVE-2026-46176) in the RDMA mlx5 driver occurs in the mlx5_ib_dev_res_srq_init() function, which allocates two SRQs (s0 and s1). If the allocation of s1 fails, the error handling code incorrectly falls through, assigning freed and error pointers to device resources. This causes the lock-free fast path to misinterpret an ERR_PTR as initialized, and leads to use-after-free and double-free conditions during subsequent operations. The flaw is fixed by adding a proper error handling jump to avoid fall-through. This vulnerability is tracked under CWE-825 (use-after-free).
Potential Impact
Exploitation of this vulnerability can lead to kernel memory corruption due to use-after-free and double-free conditions, potentially causing system instability, crashes, or privilege escalation. The CVSS v3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported. The issue affects Linux kernel versions used in Red Hat Enterprise Linux 9 and 10 distributions.
Mitigation Recommendations
A vendor-provided official fix is available as part of Red Hat Enterprise Linux kernel updates (e.g., kernel-5.14.0-687.19.1.el9_8 for RHEL 9 and kernel-6.12.0-55.84.1.el10_0 for RHEL 10). Systems should be updated promptly using the vendor's recommended procedures and rebooted to apply the kernel update. Refer to Red Hat advisories RHSA-2026:30848 and RHSA-2026:33215 for detailed instructions. No additional mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-46176
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- 3.1
Threat ID: 6a19fed3e29bf47b500fe47b
Added to database: 05/29/2026, 21:02:11 UTC
Last enriched: 07/03/2026, 00:56:49 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.