CVE-2026-46265 - Vulnerability Details

- RDMA/hns: Fix WQ_MEM_RECLAIM warning

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix WQ_MEM_RECLAIM warning

When sunrpc is used, if a reset triggered, our wq may lead the
following trace:

workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma]
is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle
[hns_roce_hw_v2]
WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144
Call trace:
check_flush_dependency+0xe0/0x144
start_flush_work.constprop.0+0x1d0/0x2f0
__flush_work.isra.0+0x40/0xb0
flush_work+0x14/0x30
hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2]
ib_destroy_qp_user+0x9c/0x2b4
rdma_destroy_qp+0x34/0xb0
rpcrdma_ep_destroy+0x28/0xcc [rpcrdma]
rpcrdma_ep_put+0x74/0xb4 [rpcrdma]
rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma]
xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma]
process_one_work+0x1cc/0x4d0
worker_thread+0x154/0x414
kthread+0x104/0x144
ret_from_fork+0x10/0x18

Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.

Published: 2026-06-03

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug in the RDMA/hns driver causes the workqueue to emit a WQ_MEM_RECLAIM warning when the kernel attempts to flush a queue that was not marked for memory reclamation. This represents a flaw in resource management (CWE-821), leading to improper memory handling but not providing an execution path for an attacker. The warning is purely diagnostic and mainly indicates potential system instability.

Affected Systems

Any Linux system running a kernel that includes the RDMA/hns code module before the patch is potentially affected. All kernel releases containing the hns_roce module and using sunrpc are relevant, as they can trigger the faulty queue flush.

Risk and Exploitability

EPSS < 1% and the vulnerability is not listed in KEV. The CVSS score of 7.5 reflects a moderate‑to‑high severity tied to potential instability rather than a direct compromise. Because the flaw does not expose secrets or allow code execution, the overall risk remains low to moderate. The likely attack vector is a local process with the ability to trigger a sunrpc reset, so remote exploitation is not feasible.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 12761bd0ae16a80f237c2a65ab1b1064076cc74a
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 70a5eb757ace5bd627a36f04d871eaf85def424d
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 562c96b1393da2df3ea62173c84117b39da353b9
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< 0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< c5ef9a1bcf5b597695d9c2e6ac452e9f89521862
`ffd541d45726341c1830ff595fd7352b6d1cfbcd`	affected	< c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,12761bd0ae16a80f237c2a65ab1b1064076cc74a)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,70a5eb757ace5bd627a36f04d871eaf85def424d)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,562c96b1393da2df3ea62173c84117b39da353b9)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,c5ef9a1bcf5b597695d9c2e6ac452e9f89521862)`	affected	code_commit	—
`[ffd541d45726341c1830ff595fd7352b6d1cfbcd,c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel update that includes the fix for the missing WQ_MEM_RECLAIM flag (CVE-2026-46265).
Ensure the hns_roce module is reloaded or the system is rebooted so the new workqueue logic takes effect.
If RDMA usage is optional, disable the hns_roce module to eliminate the exposed code path until the patch is applied.

Generated by OpenCVE AI on June 9, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00371.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27
https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a
https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9
https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d
https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6
https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862
https://lore.kernel.org/linux-cve-announce/2026060337-CVE-2026-46265-492c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46265
https://www.cve.org/CVERecord?id=CVE-2026-46265

History

Tue, 09 Jun 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Fri, 05 Jun 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 04 Jun 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Thu, 04 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026060337-CVE-2026-46265-492c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46265 https://www.cve.org/CVERecord?id=CVE-2026-46265

Wed, 03 Jun 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Wed, 03 Jun 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma] is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle [hns_roce_hw_v2] WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144 Call trace: check_flush_dependency+0xe0/0x144 start_flush_work.constprop.0+0x1d0/0x2f0 __flush_work.isra.0+0x40/0xb0 flush_work+0x14/0x30 hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2] ib_destroy_qp_user+0x9c/0x2b4 rdma_destroy_qp+0x34/0xb0 rpcrdma_ep_destroy+0x28/0xcc [rpcrdma] rpcrdma_ep_put+0x74/0xb4 [rpcrdma] rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma] xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma] process_one_work+0x1cc/0x4d0 worker_thread+0x154/0x414 kthread+0x104/0x144 ret_from_fork+0x10/0x18 Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.
Title		RDMA/hns: Fix WQ_MEM_RECLAIM warning
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27 https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9 https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6 https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-03T15:50:05.933Z

Updated: 2026-06-05T06:06:37.771Z

Reserved: 2026-05-13T15:03:33.108Z

Link: CVE-2026-46265

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-06-03T18:16:28.013

Modified: 2026-06-09T19:46:48.330

Link: CVE-2026-46265

Redhat

Severity :

Publid Date: 2026-06-03T00:00:00Z

Links: CVE-2026-46265 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-09T23:45:15Z

Weaknesses

CWE-821
Incorrect Synchronization
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object