HIGH
rdma WorkQueue Deadlock
CVE-2026-46265
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma] is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle [hns_roce_hw_v2] WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144 Call trace: check_flush_dependency+0xe0/0x144 start_flush_work.constprop.0+0x1d0/0x2f0 __flush_work.isra.0+0x40/0xb0 flush_work+0x14/0x30 hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2] ib_destroy_qp_user+0x9c/0x2b4 rdma_destroy_qp+0x34/0xb0 rpcrdma_ep_destroy+0x28/0xcc [rpcrdma] rpcrdma_ep_put+0x74/0xb4 [rpcrdma] rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma] xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma] process_one_work+0x1cc/0x4d0 worker_thread+0x154/0x414 kthread+0x104/0x144 ret_from_fork+0x10/0x18 Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.
02KernelScan AI Analysis
Risk summary
Systems using HNS RoCE hardware with sunrpc RDMA transport are at risk of kernel deadlocks during memory pressure scenarios. The vulnerability can cause system hangs when QP destruction occurs during memory reclaim operations, affecting system availability.
Vulnerability analysis
The HNS RoCE driver creates a workqueue without the WQ_MEM_RECLAIM flag, but uses it in memory reclaim paths during QP destruction. This violates kernel workqueue dependency rules and can cause deadlocks when memory reclaim workqueues try to flush work on this non-reclaim workqueue. The fix adds the WQ_MEM_RECLAIM flag to properly mark the workqueue as safe for memory reclaim operations. Attack surface is limited to systems with HNS RoCE hardware running RDMA workloads, particularly NFS over RDMA.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.1 | 6.1.165 | 12761bd0ae16 |
| 6.12 | 6.12.75 | 562c96b1393d |
| 6.18 | 6.18.14 | 0cbec8b49270 |
| 6.19 | 6.19.4 | c5ef9a1bcf5b |
| 6.6 | 6.6.128 | 70a5eb757ace |
| mainline | 7.0 | c0a26bbd3f99 |