vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-46145

RDMA/mana: Validate rx_hash_key_len

HIGH
7.8
CVSS Score
Published: May 28, 2026 at 09:36 AM UTC
Updated: October 19, 2026 at 08:18 PM UTC
2 products affected across 2 vendorsLinux KernelEnterprise Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the memcpy cannot overflow.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
6.13 ≤ v < 6.18.306.19 ≤ v < 7.0.76.2 ≤ v < 6.6.1416.7 ≤ v < 6.12.88266a177631d4c6b963b5b12dd986a8c5abdbf67.17.1 rc17.1 rc2
Vendor states this is fixed in 012796f9541fcd0c1fa8ae4da7eb4d83931ef838 (fixed)
Vendor states this is fixed in 11c1431d641e0e4e0529e96957995820600c7287 (fixed)
Vendor states this is fixed in 6dd2d4ad9c8429523b1c220c5132bd551c006425 (fixed)
Vendor states this is fixed in 7d7c9f0fcd19c4d2f0164347c58d49cafa961b72 (fixed)
Vendor states this is fixed in 7d94f155f354b961c598f71bafa804dceded513f (fixed)
Vendor states this is fixed in 6.12.88 (unaffected)
Vendor states this is fixed in 6.18.30 (unaffected)
Vendor states this is fixed in 6.2 (unaffected)
Vendor states this is fixed in 6.6.141 (unaffected)
Vendor states this is fixed in 7.0.7 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)
Enterprise Linux· Red Hatrpm
60%
9
Vendor states this is fixed in 0:4.18.0-553.136.1.el8_10 (unaffected)
Vendor states this is fixed in 0:4.18.0-553.136.1.rt7.477.el8_10 (unaffected)
Vendor states this is fixed in 0:5.14.0-427.149.1.el9_4 (unaffected)
Vendor states this is fixed in 0:5.14.0-570.138.1.el9_6 (unaffected)
Vendor states this is fixed in 0:5.14.0-687.17.1.el9_8 (unaffected)
Vendor states this is fixed in 0:6.12.0-211.28.1.el10_2 (unaffected)
Vendor states this is fixed in 0:6.12.0-55.103.1.el10_0 (unaffected)
Vendor states this is fixed in 6 (unaffected)
Vendor states this is fixed in 7 (unaffected)

References (15)

Patch
Source: cverecord
https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72
Patch
Source: cverecord
https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287
Patch
Source: cverecord
https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838
Patch
Source: cverecord
https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513f
Patch
Source: cverecord
https://git.kernel.org/stable/c/6dd2d4ad9c8429523b1c220c5132bd551c006425
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:27353
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:27354
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:27789

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-787CWE-120

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card