CVE-2026-46112: Linux Kernel Privilege Escalation Flaw

CVE-2026-46112 Overview

CVE-2026-46112 is a locking flaw in the Linux kernel's RDMA/hns driver, which supports HiSilicon RoCE (RDMA over Converged Ethernet) hardware. The function hns_roce_qp_remove() requires callers to hold specific locks before invocation. The error unwind path inside hns_roce_create_qp_common() calls this function without acquiring those locks. This unlocked call can race with concurrent queue pair operations and corrupt kernel memory. The upstream fix acquires the same locks used by the other two callers of hns_roce_qp_remove().

Critical Impact
A race condition in the QP (queue pair) error cleanup path can corrupt kernel memory structures, leading to potential denial of service or memory integrity issues on systems using HiSilicon RoCE RDMA hardware.

Affected Products

Linux kernel (mainline and stable branches prior to the fix)
Systems using the RDMA/hns driver for HiSilicon RoCE devices
Distributions shipping kernels that include the affected hns_roce_create_qp_common() error path

Discovery Timeline

2026-05-28 - CVE-2026-46112 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46112

Vulnerability Analysis

The vulnerability resides in the RDMA/hns driver, which provides InfiniBand verbs support for HiSilicon RoCE network adapters. The function hns_roce_qp_remove() mutates shared queue pair (QP) tracking structures and documents a precondition that the caller must hold the relevant locks.

Two of the three callers honor this contract. The third caller, the error unwind path inside hns_roce_create_qp_common(), invokes hns_roce_qp_remove() without acquiring the locks. When QP creation fails partway through initialization, the cleanup code runs concurrently with other threads that may legitimately hold the locks and manipulate the same QP tables. This race condition [CWE-362] can corrupt the in-kernel QP bookkeeping data structures.

The fix grabs the same locks used by the other two callers before invoking hns_roce_qp_remove() in the error path, restoring the documented locking contract.

Root Cause

The root cause is a violation of an implicit locking contract. hns_roce_qp_remove() assumes the caller holds the QP table locks, but the error unwind branch in hns_roce_create_qp_common() was written without grabbing them. Sashiko identified that this asymmetry between the success path and the error path could allow concurrent access to shared QP state.

Attack Vector

Triggering the flaw requires the ability to create RDMA queue pairs on a system using a HiSilicon RoCE device, and the ability to induce QP creation failures concurrent with other RDMA activity. Exploitation generally requires local access with permission to issue RDMA verbs. The practical outcome is kernel memory corruption in QP tracking structures, which can manifest as a kernel crash or undefined kernel behavior.

No verified proof-of-concept code is published for this issue. The vulnerability is described in the upstream commit messages referenced by the kernel.org stable tree.

Detection Methods for CVE-2026-46112

Indicators of Compromise

Kernel oops or panic messages referencing hns_roce_qp_remove, hns_roce_create_qp_common, or the hns_roce module in dmesg or /var/log/kern.log.
Unexpected RDMA connection failures or queue pair allocation errors on systems with HiSilicon RoCE adapters.
KASAN or lockdep warnings flagging concurrent access to QP table structures in the hns_roce driver.

Detection Strategies

Inventory Linux hosts running affected kernel versions and identify those loading the hns_roce_hw_v2 or related modules via lsmod | grep hns_roce.
Enable kernel lockdep and KASAN on test systems to surface unlocked QP table access during RDMA stress testing.
Correlate kernel crash dumps and kdump captures against the affected function symbols.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on stack traces containing hns_roce_qp_remove or hns_roce_create_qp_common.
Monitor RDMA subsystem health counters and QP creation failure rates on affected hardware.
Track kernel package versions across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-46112

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree as soon as your distribution publishes updated packages.
Identify hosts using HiSilicon RoCE adapters and prioritize them for kernel updates and reboots.
Restrict RDMA device access to trusted users by enforcing permissions on /dev/infiniband/* device nodes.

Patch Information

The fix is committed to the Linux kernel stable tree. The change adds the missing lock acquisition around the hns_roce_qp_remove() call in the hns_roce_create_qp_common() error path so the function is always invoked with the locks its callers are expected to hold. Patch commits are tracked at the following references:

Workarounds

If patching is not immediately feasible and RDMA is not required, unload the hns_roce driver modules and blacklist them from autoloading.
Limit access to the InfiniBand uverbs interface to administrative users to reduce the attack surface for triggering the race.
Avoid workloads that repeatedly induce QP creation failures on affected hosts until the fix is deployed.

bash

# Verify whether the hns_roce driver is loaded
lsmod | grep hns_roce

# Temporarily unload the driver if RDMA is not in use
sudo modprobe -r hns_roce_hw_v2
sudo modprobe -r hns_roce

# Prevent autoload by blacklisting until patched kernel is installed
echo 'blacklist hns_roce'        | sudo tee /etc/modprobe.d/blacklist-hns-roce.conf
echo 'blacklist hns_roce_hw_v2' | sudo tee -a /etc/modprobe.d/blacklist-hns-roce.conf

# Confirm running kernel version after applying the distribution update
uname -r