CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()

Synopsis

A resource leak vulnerability exists in the Linux kernel's RDMA/mlx4 driver, specifically in the mlx4_ib_create_srq() function. The flaw is reachable locally by a low-privileged user and requires no interaction from any other user; successful exploitation gives an attacker full read, write, and crash capability over the affected component. Patched-image rebuilds at versions 6.6.140 and 6.12.88 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path.

• Victim interactionNot required

  No other user needs to take any action; the attacker can trigger the flaw entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, memory-layout dependency, or special environmental state is required.

Blast Radius

• Reads kernel memory contents, including data belonging to other processes or security-sensitive structures.
• Writes to or corrupts kernel data structures, enabling privilege escalation or manipulation of system state.
• Crashes the host kernel by exhausting or corrupting RDMA/mlx4 driver resources through the unfreed SRQ allocation.
• Persistent access to RDMA subsystem internals may allow an attacker to affect other workloads sharing the same physical or virtual host.