CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning

Synopsis

This is a denial-of-service vulnerability in the Linux kernel's RDMA/hns driver, reachable over the network without any authentication. When the sunrpc subsystem uses RDMA and a queue-pair reset is triggered, the hns_roce_hw_v2 workqueue flushes work from an incompatible WQ_MEM_RECLAIM context, producing a kernel WARNING that can disrupt normal operation. Successful exploitation allows a remote attacker to cause a service disruption on systems using this driver. A patched-image rebuild at the fix commits (including stable branch 6.1.165) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network; an attacker must be able to send traffic to the affected service to trigger the RDMA reset path.

• AuthenticationNot required

  No authentication is needed to reach the vulnerable code path; the CVSS vector specifies PR:N.

• Victim interactionNot required

  No user or administrator action is required to trigger exploitation; the vulnerable condition arises from normal RDMA traffic handling.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or special environmental configuration.

Blast Radius

• A successful attacker causes the kernel to emit a WARNING from the workqueue dependency check, which can halt or destabilize the affected workqueue.
• The hns_roce_hw_v2 workqueue responsible for handling RDMA queue-pair teardown is disrupted, interrupting QP destruction and associated memory reclaim.
• Network-attached storage or RPC workloads running over RDMA (such as NFS or sunrpc clients) lose connectivity due to the failed reset handling.
• System availability is degraded; in the worst case the kernel panic or lockup path is reached, taking down the affected node.