Security readout for executives and security teams
Plain-English summary
A Linux kernel error can mishandle memory when an RDS RDMA operation succeeds but returning its cookie to user space fails. The same resources may then be cleaned up twice, creating a high-impact kernel memory-safety condition. The supplied CVSS score is 7.8 and describes a low-privileged, local attack requiring no user interaction.
Executive priority
Treat this as a high-priority kernel update for multi-user systems and hosts using RDS/RDMA. It is not supported as an emergency internet-wide threat because the stated attack vector is local and active exploitation is not reported. Prioritize exposed systems, then deploy vendor-supported updates through normal kernel testing and reboot procedures.
Technical view
After get_mr() succeeds, __rds_rdma_map() transfers ownership of scatter-gather data and pages to the transport. On a subsequent put_user() failure, the vulnerable branch unpins and frees those resources before dropping the MR reference, allowing final teardown to repeat cleanup. The referenced stable patches remove the duplicate cleanup and rely on the existing final path.
Likely exposure
Exposure is most plausible on affected Linux kernels where RDS/RDMA functionality is present and reachable by a low-privileged local user. The supplied version data spans multiple kernel lines but is insufficiently structured to map every vulnerable distribution package. Confirm exposure using distribution advisories, package changelogs, and the referenced stable commits.
Exploitation context
The supplied record does not identify this CVE as being in KEV, and no provided source reports active exploitation or a public exploit. Its CVSS vector describes local, low-complexity exploitation with low privileges and potential high confidentiality, integrity, and availability impact. Practical prerequisites beyond the affected RDS path are not documented in the bundle.
Researcher notes
The relevant failure condition occurs after successful get_mr() ownership transfer when copying the generated cookie to user space fails. Review backports for removal of branch-level unpin/free operations and preservation of cleanup through MR reference teardown. The bundle provides no CWE classification, public proof of concept, observed exploitation, or detailed environmental prerequisites.
Mitigation direction
- Apply the vendor kernel update containing the applicable stable fix for your kernel branch.
- Prioritize systems using RDS/RDMA or permitting untrusted local users.
- If patching is delayed, consult the distribution vendor for supported temporary mitigations.
- Use vendor-tested backports rather than unsupported kernel modifications.
Validation and detection
- Inventory running kernel versions and distribution patch levels.
- Check whether RDS/RDMA modules or workloads are present on each system.
- Confirm the kernel includes the applicable referenced stable commit or vendor backport.
- After updating, verify the new kernel is running and review logs for regressions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46053 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/91a44b406bc1f9e1c5da0cb7d0d5991b43b79147CVE reference, Linux
- https://git.kernel.org/stable/c/106dc689206610cfa2098f593fdd1e020c997835CVE reference, Linux
- https://git.kernel.org/stable/c/ec55a86f7fba7d9111df94b9c11a4755ed492995CVE reference, Linux
- https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdcCVE reference, Linux
- https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085caCVE reference, Linux
- https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589aCVE reference, Linux
- https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765cCVE reference, Linux
- https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.