CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

Synopsis

This is a missing-lock (race condition leading to memory corruption) vulnerability in the Linux kernel's RDMA/hns driver, which manages HiSilicon RoCE network adapters. The flaw is reachable locally by a low-privileged user and requires no network access; exploitation occurs during an error-unwind path in queue-pair creation that fails to acquire the required locks before calling hns_roce_qp_remove(), leaving shared data structures in a corrupt state. Successful exploitation gives an attacker full read, write, and crash capabilities over the affected kernel subsystem. Patched-image rebuilds at versions 6.6.140 and 6.12.88 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerability is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path; no administrative rights are needed.

• Victim interactionNot required

  No action from another user or process is required; the attacker can trigger the flaw independently.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race timing, memory-layout knowledge, or special environmental state is required beyond local access.

Blast Radius

• Reads kernel memory, exposing sensitive data such as credentials, cryptographic material, or other processes' memory contents.
• Writes to kernel data structures, allowing modification of security controls, process permissions, or persisted state.
• Corrupts shared kernel memory through the unlocked removal path, which can crash the host or destabilize the RDMA subsystem for all users on the machine.
• Privilege escalation to root is a realistic outcome given full kernel read and write access.