CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

Synopsis

A use-after-free and uninitialized-object race condition exists in the Linux kernel's RDMA/mlx4 driver, specifically in the mlx4_srq_event() function. An attacker with a low-privilege local shell on the host can trigger the flaw by racing hardware RDMA events against shared receive queue (SRQ) initialization or teardown, exploiting incorrect RCU locking that fails to protect the mlx4_srq struct. Successful exploitation gives the attacker full read, write, and execution capability over kernel memory. A patched-image rebuild is available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the race condition; no administrative rights are needed.

• Victim interactionNot required

  No user interaction is required; the attacker triggers the vulnerability entirely through their own process.

• Attack complexityDetail

  Exploit complexity is low: the race condition is reliably triggerable without special memory layout or environmental prerequisites beyond local access.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing credentials, session tokens, and data belonging to any process on the host.
• A successful attacker writes to arbitrary kernel memory, allowing modification of kernel data structures, process credentials, or persisted data.
• A successful attacker can achieve kernel-level code execution, giving full control over the host operating system.
• All containers and workloads sharing the affected kernel on the same host are exposed to compromise.