CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

Synopsis

A use-after-free and double-free vulnerability exists in the Linux kernel's RDMA/mlx5 driver, specifically in the mlx5_ib_dev_res_srq_init() function. The flaw is reachable locally by an authenticated low-privilege user and, when triggered, allows the attacker to read kernel memory, tamper with kernel data structures, and crash or take control of the affected host. Patched-image rebuilds at the fix versions (6.6.140, 6.12.88, 6.18.30, and commit 6fd93142dd1d) are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the faulty error path in the RDMA driver.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerability directly without social engineering.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race conditions or special memory layout requirements are documented.

Blast Radius

• An attacker reads arbitrary kernel memory, including sensitive data such as credentials, keys, or session tokens held in kernel space.
• An attacker corrupts kernel data structures through the double-free and use-after-free, allowing modification of persisted kernel state or security policy objects.
• An attacker crashes the affected host by triggering the double-free or dereferencing the ERR_PTR during teardown, causing a kernel panic.
• In the worst case, the attacker achieves arbitrary kernel code execution by exploiting the freed SRQ or ERR_PTR dereference to redirect kernel control flow.