CVE-2026-46112

RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

State: Published
Severity: 7.8 High
Published: May 28, 2026
Updated: Aug 5, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix unlocked call to hns_roce_qp_remove()

Sashiko points out that hns_roce_qp_remove() requires the caller to hold locks. The error flow in hns_roce_create_qp_common() doesn't hold those locks for the error unwind so it risks corrupting memory.

Grab the same locks the other two callers use.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e088a685eae94a0607b8f7b99949a0e14d748813 to before 1f0a3aa8b569d010316b427238222c5d899f9618Affected e088a685eae94a0607b8f7b99949a0e14d748813 to before b6296ff2475fc95ee6ea1b528c4b385302808186Affected e088a685eae94a0607b8f7b99949a0e14d748813 to before fb4ae739811d467409bd07d0e36cfd4140f3d26aAffected e088a685eae94a0607b8f7b99949a0e14d748813 to before fcf6a832c0d5b2bc5398d6996c5570d3ee7993fbAffected e088a685eae94a0607b8f7b99949a0e14d748813 to before 1912f78798505dc9c637081bbddfbf1c22494c49Affected e088a685eae94a0607b8f7b99949a0e14d748813 to before 615d9d260c32bb678504ca96f29ae46f9d745155Affected e088a685eae94a0607b8f7b99949a0e14d748813 to before 0c99acbc8b6c6dd526ae475a48ee1897b61072fbAffected
LinuxLinux	4.17Affected before 4.17Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.88 through 6.12.Not affected 6.18.30 through 6.18.Not affected 7.0.7 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

e088a685eae94a0607b8f7b99949a0e14d748813 to before 1f0a3aa8b569d010316b427238222c5d899f9618Affected
e088a685eae94a0607b8f7b99949a0e14d748813 to before b6296ff2475fc95ee6ea1b528c4b385302808186Affected
e088a685eae94a0607b8f7b99949a0e14d748813 to before fb4ae739811d467409bd07d0e36cfd4140f3d26aAffected
e088a685eae94a0607b8f7b99949a0e14d748813 to before fcf6a832c0d5b2bc5398d6996c5570d3ee7993fbAffected
e088a685eae94a0607b8f7b99949a0e14d748813 to before 1912f78798505dc9c637081bbddfbf1c22494c49Affected
e088a685eae94a0607b8f7b99949a0e14d748813 to before 615d9d260c32bb678504ca96f29ae46f9d745155Affected
e088a685eae94a0607b8f7b99949a0e14d748813 to before 0c99acbc8b6c6dd526ae475a48ee1897b61072fbAffected

LinuxLinux

4.17Affected
before 4.17Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.88 through 6.12.*Not affected
6.18.30 through 6.18.*Not affected
7.0.7 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.