CVE-2026-46181 Overview
CVE-2026-46181 is a Linux kernel vulnerability in the RDMA/mlx4 driver. The flaw involves misuse of Read-Copy-Update (RCU) synchronization within the mlx4_srq_event() function. While the radix_tree itself is RCU safe, the mlx4_srq struct is never freed via RCU and is not accessed within an RCU critical section. The driver can also crash when an event is delivered before the Shared Receive Queue (SRQ) object finishes initializing. The upstream fix replaces RCU with spinlock-based synchronization and uses refcount_inc_not_zero() to guard against partially initialized objects.
Critical Impact
A race condition between SRQ event delivery and object initialization can cause kernel crashes on systems using Mellanox ConnectX RDMA adapters.
Affected Products
- Linux kernel — RDMA/mlx4 driver subsystem
- Systems using Mellanox ConnectX InfiniBand/Ethernet adapters with the mlx4 driver
- Distributions shipping affected stable kernel branches prior to the fix commits
Discovery Timeline
- 2026-05-28 - CVE-2026-46181 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46181
Vulnerability Analysis
The vulnerability resides in the mlx4_srq_event() function within the Linux kernel's RDMA/mlx4 driver. The driver maintains Shared Receive Queue (SRQ) objects in a radix_tree data structure, which itself supports RCU-based concurrent access. However, the surrounding logic incorrectly assumed RCU protection extended to the mlx4_srq object lifecycle.
The mlx4_srq structures are never freed through RCU callbacks, and the event handler accesses the object outside any RCU critical section. This creates two distinct hazards. First, the object can be freed concurrently with event handling, producing a use-after-free condition [CWE-416]. Second, an asynchronous event delivered before SRQ initialization completes can dereference partially constructed state, causing a kernel crash.
Root Cause
The root cause is incorrect synchronization design. Developers relied on RCU semantics for object access without ensuring RCU-deferred reclamation or proper critical section boundaries. The reference count was also set before the SRQ object was fully initialized, allowing event consumers to observe and operate on an incomplete object.
Attack Vector
The issue is triggered by timing-sensitive interactions between SRQ creation and asynchronous hardware event delivery. Local workloads using RDMA verbs to create and destroy SRQs concurrently with traffic generation can race the event path. The result is a denial of service through kernel panic, with potential for further memory corruption depending on allocator behavior.
No verified exploitation code is publicly available. Triggering the race requires local access and the ability to issue RDMA operations against an mlx4-managed device.
Detection Methods for CVE-2026-46181
Indicators of Compromise
- Kernel oops or panic messages referencing mlx4_srq_event, mlx4_ib, or RDMA subsystem stack frames in dmesg or /var/log/kern.log.
- Unexpected reboots or RDMA service interruptions on hosts using Mellanox ConnectX adapters.
- KASAN reports identifying use-after-free or uninitialized memory access within the mlx4 driver paths.
Detection Strategies
- Inventory running kernel versions against the patched stable branches referenced in the upstream commits (1e2a44875b6a, 8b7833f3bce3, c9341307ea16).
- Enable kernel runtime diagnostics such as KASAN and lockdep in test environments to surface RCU misuse during RDMA stress workloads.
- Correlate RDMA-related crash signatures across fleet telemetry to identify systems exposed to the race condition.
Monitoring Recommendations
- Forward dmesg and kernel ring buffer output to a centralized logging platform and alert on stack traces containing mlx4_srq_event.
- Track host uptime and unplanned reboot events on RDMA-enabled servers used for storage, HPC, or AI workloads.
- Monitor InfiniBand subnet manager logs for unexpected node disconnects that may indicate kernel crashes on endpoints.
How to Mitigate CVE-2026-46181
Immediate Actions Required
- Identify hosts running the mlx4 driver with lspci -k | grep -A3 Mellanox and lsmod | grep mlx4 to scope exposure.
- Apply the upstream stable kernel updates that include commits 1e2a44875b6a, 8b7833f3bce3, and c9341307ea16.
- Restrict local access on systems that cannot be immediately patched, since the race requires local RDMA verb usage.
Patch Information
The fix replaces RCU-based access with spinlock synchronization in mlx4_srq_event(). It introduces refcount_inc_not_zero() to safely reject access to partially initialized objects and reorders refcount_set() to occur only after the SRQ is fully constructed. Patches are available in the Linux stable tree commit 1e2a44875b6a, commit 8b7833f3bce3, and commit c9341307ea16.
Workarounds
- Where patching is not immediately feasible, unload the mlx4_ib module on hosts that do not require RDMA functionality.
- Limit creation and destruction of SRQ objects in production workloads to reduce the race window until the kernel is updated.
- Apply vendor-provided kernel updates from your Linux distribution as soon as they integrate the upstream fix.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
