CVE-2026-46265

RDMA/hns: Fix WQ_MEM_RECLAIM warning

Published Jun 3, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix WQ_MEM_RECLAIM warning

When sunrpc is used, if a reset triggered, our wq may lead the
following trace:

workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma]
is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle
[hns_roce_hw_v2]
WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144
Call trace:
check_flush_dependency+0xe0/0x144
start_flush_work.constprop.0+0x1d0/0x2f0
__flush_work.isra.0+0x40/0xb0
flush_work+0x14/0x30
hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2]
ib_destroy_qp_user+0x9c/0x2b4
rdma_destroy_qp+0x34/0xb0
rpcrdma_ep_destroy+0x28/0xcc [rpcrdma]
rpcrdma_ep_put+0x74/0xb4 [rpcrdma]
rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma]
xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma]
process_one_work+0x1cc/0x4d0
worker_thread+0x154/0x414
kthread+0x104/0x144
ret_from_fork+0x10/0x18

Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.

Analysis

Technical impact

The bug in the RDMA/hns driver causes the workqueue to emit a WQ_MEM_RECLAIM warning when the kernel attempts to flush a queue that was not marked for memory reclamation. This represents a flaw in resource management (CWE-821), leading to improper memory handling but not providing an execution path for an attacker. The warning is purely diagnostic and mainly indicates potential system instability.

Affected Systems

Any Linux system running a kernel that includes the RDMA/hns code module before the patch is potentially affected. All kernel releases containing the hns_roce module and using sunrpc are relevant, as they can trigger the faulty queue flush.

Risk and Exploitability

EPSS < 1% and the vulnerability is not listed in KEV. The CVSS score of 7.5 reflects a moderate‑to‑high severity tied to potential instability rather than a direct compromise. Because the flaw does not expose secrets or allow code execution, the overall risk remains low to moderate. The likely attack vector is a local process with the ability to trigger a sunrpc reset, so remote exploitation is not feasible.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 12761bd0ae16a80f237c2a65ab1b1064076cc74a
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 70a5eb757ace5bd627a36f04d871eaf85def424d
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 562c96b1393da2df3ea62173c84117b39da353b9
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< c5ef9a1bcf5b597695d9c2e6ac452e9f89521862
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,12761bd0ae16a80f237c2a65ab1b1064076cc74a)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,70a5eb757ace5bd627a36f04d871eaf85def424d)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,562c96b1393da2df3ea62173c84117b39da353b9)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,c5ef9a1bcf5b597695d9c2e6ac452e9f89521862)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel update that includes the fix for the missing WQ_MEM_RECLAIM flag (CVE-2026-46265).
Ensure the hns_roce module is reloaded or the system is rebooted so the new workqueue logic takes effect.
If RDMA usage is optional, disable the hns_roce module to eliminate the exposed code path until the patch is applied.

Generated by OpenCVE AI on June 9, 2026 at 23:41 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.389% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27
https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a
https://git.kernel.org/stable/c/31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2
https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9
https://git.kernel.org/stable/c/5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef
https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d
https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6
https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862
https://lore.kernel.org/linux-cve-announce/2026060337-CVE-2026-46265-492c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46265
https://www.cve.org/CVERecord?id=CVE-2026-46265

History

Oct 30, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2 https://git.kernel.org/stable/c/5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef

Jun 9, 2026 8:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Jun 5, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Jun 4, 2026 2:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-665

Jun 4, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026060337-CVE-2026-46265-492c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46265 https://www.cve.org/CVERecord?id=CVE-2026-46265

Jun 3, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-665

Jun 3, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma] is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle [hns_roce_hw_v2] WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144 Call trace: check_flush_dependency+0xe0/0x144 start_flush_work.constprop.0+0x1d0/0x2f0 __flush_work.isra.0+0x40/0xb0 flush_work+0x14/0x30 hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2] ib_destroy_qp_user+0x9c/0x2b4 rdma_destroy_qp+0x34/0xb0 rpcrdma_ep_destroy+0x28/0xcc [rpcrdma] rpcrdma_ep_put+0x74/0xb4 [rpcrdma] rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma] xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma] process_one_work+0x1cc/0x4d0 worker_thread+0x154/0x414 kthread+0x104/0x144 ret_from_fork+0x10/0x18 Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.
Title		RDMA/hns: Fix WQ_MEM_RECLAIM warning
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27 https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9 https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6 https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862