{"id":"CVE-2026-46265","state":"PUBLISHED","title":"RDMA/hns: Fix WQ_MEM_RECLAIM warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix WQ_MEM_RECLAIM warning\n\nWhen sunrpc is used, if a reset triggered, our wq may lead the\nfollowing trace:\n\nworkqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma]\nis flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle\n[hns_roce_hw_v2]\nWARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144\nCall trace:\n  check_flush_dependency+0xe0/0x144\n  start_flush_work.constprop.0+0x1d0/0x2f0\n  __flush_work.isra.0+0x40/0xb0\n  flush_work+0x14/0x30\n  hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2]\n  ib_destroy_qp_user+0x9c/0x2b4\n  rdma_destroy_qp+0x34/0xb0\n  rpcrdma_ep_destroy+0x28/0xcc [rpcrdma]\n  rpcrdma_ep_put+0x74/0xb4 [rpcrdma]\n  rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma]\n  xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma]\n  process_one_work+0x1cc/0x4d0\n  worker_thread+0x154/0x414\n  kthread+0x104/0x144\n  ret_from_fork+0x10/0x18\n\nSince QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.","publishedAt":"2026-06-03T15:50:05.933Z","updatedAt":"2026-10-30T12:26:14.155Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"12761bd0ae16a80f237c2a65ab1b1064076cc74a","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"70a5eb757ace5bd627a36f04d871eaf85def424d","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"562c96b1393da2df3ea62173c84117b39da353b9","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"c5ef9a1bcf5b597695d9c2e6ac452e9f89521862","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.165","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.128","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.75","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.14","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.4","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"]}],"references":["https://git.kernel.org/stable/c/31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2","https://git.kernel.org/stable/c/5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef","https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a","https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d","https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9","https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27","https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862","https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6"],"weaknesses":[],"ingestedAt":"2026-10-30T12:44:04.813Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/46xxx/CVE-2026-46265.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46265","state":"PUBLISHED","datePublished":"2026-06-03T15:50:05.933Z","dateUpdated":"2026-10-30T12:26:14.155Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-13T15:03:33.108Z"},"containers":{"cna":{"title":"RDMA/hns: Fix WQ_MEM_RECLAIM warning","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix WQ_MEM_RECLAIM warning\n\nWhen sunrpc is used, if a reset triggered, our wq may lead the\nfollowing trace:\n\nworkqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma]\nis flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle\n[hns_roce_hw_v2]\nWARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144\nCall trace:\n  check_flush_dependency+0xe0/0x144\n  start_flush_work.constprop.0+0x1d0/0x2f0\n  __flush_work.isra.0+0x40/0xb0\n  flush_work+0x14/0x30\n  hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2]\n  ib_destroy_qp_user+0x9c/0x2b4\n  rdma_destroy_qp+0x34/0xb0\n  rpcrdma_ep_destroy+0x28/0xcc [rpcrdma]\n  rpcrdma_ep_put+0x74/0xb4 [rpcrdma]\n  rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma]\n  xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma]\n  process_one_work+0x1cc/0x4d0\n  worker_thread+0x154/0x414\n  kthread+0x104/0x144\n  ret_from_fork+0x10/0x18\n\nSince QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"12761bd0ae16a80f237c2a65ab1b1064076cc74a","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"70a5eb757ace5bd627a36f04d871eaf85def424d","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"562c96b1393da2df3ea62173c84117b39da353b9","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"c5ef9a1bcf5b597695d9c2e6ac452e9f89521862","versionType":"git"},{"version":"ffd541d45726341c1830ff595fd7352b6d1cfbcd","status":"affected","lessThan":"c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.165","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.128","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.75","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.14","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.4","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2"},{"url":"https://git.kernel.org/stable/c/5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef"},{"url":"https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a"},{"url":"https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d"},{"url":"https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9"},{"url":"https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27"},{"url":"https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862"},{"url":"https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when an RPC-over-RDMA path tears down a HiSilicon HNS queue pair; remote NFS/RDMA peers can force disconnect/reconnect and QP destruction on internet- or fabric-facing storage nodes (svc_rdma / rpcrdma), which is network-driven rather than purely local ioctl access.\nAC:L - Once NFS-over-RDMA and HNS RoCE are enabled, a remote peer can repeatedly trigger disconnect and failed reconnect work; combined with routine memory-reclaim pressure (PF_MEMALLOC on the NFS swap path) or NIC reset, the WARN/deadlock path is attacker-influenceable without rare one-off victim state.\nPR:N - On an NFS-over-RDMA server the vulnerable ib_destroy_qp/flush_work path runs while handling RDMA CM disconnects from network clients, before any per-file NFS authorization; no local UNIX privileges on the victim are required beyond the service already being exposed.\nUI:N - Exploitation requires only network traffic and kernel-side RPC/RDMA handling; no end-user actions such as mounting a filesystem or clicking a link are needed on the victim.\nS:U - Impact is confined to kernel workqueue forward-progress and availability on the host running the HNS driver; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The flaw is a missing WQ_MEM_RECLAIM flag leading to check_flush_dependency WARN_ONCE and possible reclaim deadlock; there is no memory corruption, out-of-bounds access, or use-after-free that could yield information disclosure.\nI:N - No attacker-controlled writes, type confusion, or code-execution primitive exist; the failure mode is a workqueue dependency violation during QP flush/destroy, not integrity compromise of data or code.\nA:H - Violating the workqueue forward-progress rule can deadlock memory reclaim, and the observed WARN_ONCE becomes a kernel panic when panic_on_warn is enabled; even without panic, a stuck reclaim path is a full host availability failure."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:26:14.155Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.128"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.75"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.18.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.19.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}