huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-4600: jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters
Component: jsrsasign
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Public date: 2026-03-23T05:00:08.475000+00:00

A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.

Statement: IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.

Affected upstream versions: <= 11.1.0
Fixed upstream versions: *, 11.1.1
Upstream repository: https://github.com/kjur/jsrsasign
Upstream fix commit: 37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60
CVE-2026-4601: jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing
Component: jsrsasign
Severity: Important
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 8.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)
Public date: 2026-03-23T05:00:13.312000+00:00

A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.

Statement: IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.

Affected upstream versions: <= 11.1.0
Fixed upstream versions: *, 11.1.1
Upstream repository: https://github.com/kjur/jsrsasign
Upstream fix commit: 0710e392ec35de697ce11e4219c988ba2b5fe0eb
CVE-2026-4602: jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling
Component: jsrsasign
Severity: Important
CWE: CWE-681 (Incorrect Conversion between Numeric Types)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-03-23T05:00:10.567000+00:00

A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.

Statement: This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.

Affected upstream versions: <= 11.1.0
Fixed upstream versions: *, 11.1.1
Upstream repository: https://github.com/kjur/jsrsasign
Upstream fix commit: 5ea1c32bb2aa894b4bd29849839afe4f98728195
CVE-2026-46037: kernel: ipv4: icmp: validate reply type before using icmp_pointers
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within its IPv4 Internet Control Message Protocol (ICMP) component. This vulnerability occurs because the system does not properly check the type of ICMP replies before attempting to process them. An attacker could potentially exploit this by sending specially crafted extended echo replies, which might cause the system to access memory outside of its intended boundaries. This could lead to system instability, such as a crash, or potentially expose sensitive information.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.209, 6.1.175, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99
CVE-2026-46054: kernel: selinux: fix overlayfs mmap() and mprotect() access checks
Component: kernel
Severity: Important
CWE: CWE-280 (Improper Handling of Insufficient Permissions or Privileges)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for `mmap()` and `mprotect()` operations. This oversight could allow a local attacker to bypass intended security policies, potentially leading to unauthorized access to files within an overlayfs filesystem. The vulnerability is resolved by enhancing backing file enforcement for `mmap()` and leveraging new LSM (Linux Security Module) capabilities for `mprotect()` access controls.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 6.12.95, 6.18.38, 6.6.144, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bc6c380c1159de52a252ed11f19a42c47f60a735
CVE-2026-46056: kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free (UAF), exists within the Secure Simple Pairing (SSP) passkey handlers. It occurs when `hci_conn` lookup and field access are performed without proper locking, allowing a connection to be freed concurrently. This could potentially enable a local attacker to cause a denial of service or execute arbitrary code.


Affected upstream versions: 3.7
Fixed upstream versions: 0, 5.10.259, 5.15.210, 6.1.175, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ea18732d2614557e59f4c0d8cdbe6611aeab33b7
CVE-2026-46086: kernel: net: bridge: use a stable FDB dst snapshot in RCU readers
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel. Inconsistent handling of local Forwarding Database (FDB) entries in the bridge networking component's RCU (Read-Copy-Update) readers can lead to a null-pointer dereference. A local attacker could exploit this by triggering a concurrent update to an FDB entry, causing the system to crash and resulting in a Denial of Service (DoS).

Statement: Bridge FDB RCU readers could load f dst more than once while a local FDB update rewrites that pointer in place to another port or NULL. A concurrent update can make the reader pass a NULL check and later dereference a different NULL value, causing a kernel crash in paths such as br_fdb_fillbuf. Impact is denial of service only.

Affected upstream versions: 3.14
Fixed upstream versions: 0, 5.10.259, 5.15.210, 6.1.176, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c502fa9f094cb03d1d1685c71e2105ab359bc2b8
CVE-2026-46090: kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop
Component: kernel
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) aloop driver. This Use-After-Free (UAF) vulnerability occurs when loopback_check_format() stops the capture side during a format change, while a concurrent close operation detaches or frees the runtime. An attacker could potentially exploit this to cause a system crash or achieve arbitrary code execution.


Affected upstream versions: 2.6.37
Fixed upstream versions: 0, 5.10.259, 5.15.210, 6.12.88, 6.18.27, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 83bd62fa9620ac98d5d694bde14c50f98c8e7189
CVE-2026-46099: kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
Component: kernel
Severity: Important
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the `seg6` and `rpl` lwtunnels. A race condition can occur when handling destination cache entries, where a `NOREF` (no reference) destination object is used after it has been freed. This use-after-free vulnerability can lead to system instability or a denial of service (DoS) on systems configured with `PREEMPT_RT` (Preemptible Real-Time) kernel.


Affected upstream versions: 4.12
Fixed upstream versions: 0, 5.15.209, 6.1.175, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 51fef5a7c4d160839199e941929456ba21ddf73c
CVE-2026-46113: kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 shadow paging mechanism. This use-after-free vulnerability arises from incorrect handling of Guest Frame Numbers (GFNs) when guest page tables are modified. A local attacker with control over a guest virtual machine could exploit this to dereference freed memory, potentially leading to information disclosure, privilege escalation, or a denial of service (DoS).

Statement: The attack vector is from the guest to the host if KVM being used (and Shadow paging being used). KVM x86 shadow paging can leave a stale rmap entry when a direct shadow page is reused with an unexpected GFN after guest page table changes between VM entries. Later memslot deletion, dirty logging, or MMU notifier invalidation can walk the stale rmap and dereference a freed kvm_mmu_page, resulting in a use-after-free in the host kernel. For the CVSS the PR:L is used because a local actor with access to KVM or control of a guest execution context can influence the guest mappings and related memory management operations. The issue is not a normal network reachable bug, but it can cross the guest to host boundary in virtualized deployments. Impact is at least host denial of service and in the paranoid score may include confidentiality and integrity impact due to a plausible UAF based memory corruption primitive.
For the paranoid score, choose the highest still-defensible interpretation supported by the bug class and patch context, with preference for manual-review sensitivity over autoclosed false negat
ives.

Affected upstream versions: 2.6.20
Fixed upstream versions: 0, 6.1.175, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e9d4ea13aa2b6400bb10ec64b370ba3dadcd22f0
CVE-2026-46116: kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
Component: kernel
Severity: Important
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges.


Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 5.10.261, 5.15.210, 6.1.176, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6
CVE-2026-46117: kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
Component: kernel
Severity: Important
CWE: CWE-1288 (Improper Validation of Consistency within Input)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface (uAPI) that cause an internal error. This issue arises when Work Queues (WQs) are specified to share the same Completion Queue (CQ), leading to an unstable system state.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.12.91, 6.18.30, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71
CVE-2026-46125: kernel: wifi: mac80211: remove station if connection prep fails
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.8 (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When Multi-Link Operation (MLO) connection preparation fails, the system may not correctly remove the associated station. This can lead to a use-after-free or double-free vulnerability in the debugfs component, potentially causing system instability or unexpected behavior.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.176, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 18fed0a209500bfea5c4c08609ec93855e4e500b
CVE-2026-46135: kernel: nvmet-tcp: fix race between ICReq handling and queue teardown
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. A race condition exists between the handling of an Initialization Connection Request (ICReq) and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a double free vulnerability. This could lead to a denial of service (DoS) due to memory corruption.


Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.261, 5.15.212, 6.1.178, 6.12.88, 6.18.30, 6.6.144, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b7dd4d27aa70bd98bb10572310e913668baf6a65
CVE-2026-46145: kernel: RDMA/mana: Validate rx_hash_key_len
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's RDMA/mana component. A local user could exploit this vulnerability by providing an invalid `rx_hash_key_len` value through a user-space API (uAPI) structure. This invalid value is then used in a `memcpy` operation without proper bounds checking, allowing the user to write beyond intended memory boundaries. This can lead to kernel memory corruption, potentially resulting in privilege escalation or a denial of service (DoS).


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.12.88, 6.18.30, 6.6.141, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7d7c9f0fcd19c4d2f0164347c58d49cafa961b72
CVE-2026-46150: kernel: fanotify: fix false positive on permission events
Component: kernel
Severity: Moderate
CWE: CWE-280 (Improper Handling of Insufficient Permissions or Privileges)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the `fsnotify_get_mark_safe()` function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventing intended security restrictions.

Statement: This Moderate severity flaw in the Linux kernel's fanotify subsystem allows a local attacker to bypass security restrictions. An incorrect return value from `fsnotify_get_mark_safe()` can lead to unauthorized actions on Red Hat Enterprise Linux systems.

Affected upstream versions: 4.12
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a24765332e129c1916d5a6615418b75599b8fcdc
CVE-2026-46152: kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result
Component: kernel
Severity: Important
CWE: CWE-1058 (Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's Wi-Fi (mac80211) subsystem. The `ieee80211_invoke_fast_rx()` function uses a static variable for `rx_result`, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly reported. Such issues can result in unexpected network behavior or a denial of service within the wireless communication.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 03584528bfffb195e384698af9148b94e42e3f14
CVE-2026-46155: kernel: smb/client: fix out-of-bounds read in smb2_compound_op()
Component: kernel
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2_compound_op() function, allowing the attacker to leak sensitive kernel heap memory.


Affected upstream versions: 6.6.32 < 6.6.140, 6.9
Fixed upstream versions: 0, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dffb44b2e06a2908e249f0f93156fc987eee1d1c
CVE-2026-46166: kernel: wifi: mac80211: use safe list iteration in radar detect work
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's mac80211 wireless subsystem. This vulnerability arises from unsafe list iteration during radar detection work, where a channel context can be freed while still being processed. This can lead to a use-after-free memory error. A successful exploit could result in system instability or a denial of service.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.88, 6.18.30, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 887ece6c23b49d02a6678e7a8d5ad213d75883ce
CVE-2026-46173: kernel: exit: prevent preemption of oopsing TASK_DEAD task
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel. During the exit process of a task that has encountered an error, the system can incorrectly allow the task to be interrupted. This can lead to improper management of the task's memory, potentially causing memory corruption. Such an issue could allow a local attacker to cause a system crash (Denial of Service) or potentially gain elevated privileges.

Statement: This Moderate flaw in the Linux kernel can lead to memory corruption, potentially allowing a local attacker to cause a system crash or escalate privileges. The vulnerability arises from incorrect preemption handling during the exit of an error-prone task, leading to improper stack management. This issue affects Red Hat Enterprise Linux 9 and 10, and Red Hat In-Vehicle OS 2.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.175, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3d6fb8a7690c23e3213c4b008f64d89a44b98737
CVE-2026-46176: kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the `mlx5_ib_dev_res_srq_init()` function, specifically when `ib_create_srq()` fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial of service, or potentially arbitrary code execution.


Affected upstream versions: 6.6.64 < 6.6.140, 6.11
Fixed upstream versions: 0, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a13c2ac4d480b734342c6fbf8249fc48afd675f3
CVE-2026-46181: kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
Component: kernel
Severity: Important
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update (RCU) in the `mlx4_srq_event()` function. An attacker could potentially trigger an event before the `srq` object is fully initialized, leading to a system crash. This could result in a Denial of Service (DoS) for the affected system.


Affected upstream versions: 4.9
Fixed upstream versions: 0, 6.18.30, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1e2a44875b6afb4add1115f7f3351dcbeb6f273d