Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.1%top 96%

A vulnerability in the Linux kernel's RDMA mlx5 driver (mlx5_ib_dev_res_srq_init function) causes error path fall-through when allocating shared… (CVE-2026-46176)

0
High
Published: 05/28/2026 (05/28/2026, 12:30:31 UTC)
Source: GCVE Database
Vendor/Project: Microsoft Security Response Center
Product: Microsoft

Description

A vulnerability in the Linux kernel's RDMA mlx5 driver (mlx5_ib_dev_res_srq_init function) causes error path fall-through when allocating shared receive queues (SRQs). This leads to use-after-free and double-free conditions, as well as dereferencing of invalid pointers. The issue has been fixed by correcting the error handling path to prevent these unsafe operations. This vulnerability has a high severity rating and affects specific Linux kernel versions used in Red Hat Enterprise Linux 9 and 10. Updates addressing this issue are available and should be applied with a system reboot.

CVSS v3.1

Score 7.8high

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Affected versions
=3.0

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/03/2026, 00:56:49 UTC

Technical Analysis

The Linux kernel vulnerability (CVE-2026-46176) in the RDMA mlx5 driver occurs in the mlx5_ib_dev_res_srq_init() function, which allocates two SRQs (s0 and s1). If the allocation of s1 fails, the error handling code incorrectly falls through, assigning freed and error pointers to device resources. This causes the lock-free fast path to misinterpret an ERR_PTR as initialized, and leads to use-after-free and double-free conditions during subsequent operations. The flaw is fixed by adding a proper error handling jump to avoid fall-through. This vulnerability is tracked under CWE-825 (use-after-free).

Potential Impact

Exploitation of this vulnerability can lead to kernel memory corruption due to use-after-free and double-free conditions, potentially causing system instability, crashes, or privilege escalation. The CVSS v3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported. The issue affects Linux kernel versions used in Red Hat Enterprise Linux 9 and 10 distributions.

Mitigation Recommendations

A vendor-provided official fix is available as part of Red Hat Enterprise Linux kernel updates (e.g., kernel-5.14.0-687.19.1.el9_8 for RHEL 9 and kernel-6.12.0-55.84.1.el10_0 for RHEL 10). Systems should be updated promptly using the vendor's recommended procedures and rebooted to apply the kernel update. Refer to Red Hat advisories RHSA-2026:30848 and RHSA-2026:33215 for detailed instructions. No additional mitigations are indicated by the vendor advisory.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_vex
Csaf Version
2.0
Publisher
Microsoft Security Response Center
Advisory Id
msrc_CVE-2026-46176
Cve Count
1
Additional Cves
[]
Cvss Version
3.1

Threat ID: 6a19fed3e29bf47b500fe47b

Added to database: 05/29/2026, 21:02:11 UTC

Last enriched: 07/03/2026, 00:56:49 UTC

Last updated: 07/31/2026, 19:22:59 UTC

Views: 67

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses