CyberSecBulletin
CVE-2026-46181NVD status: Modified

Linux: Race Condition within a Thread

Published Updated By the CyberSecBulletin desk

CVE-2026-46181 is a high-severity race condition within a thread vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 654aeddbc6e0f6e56531985bb12328ab4230c6c1, 2d8b30b496bc53e961ba7415fd629fc27813017c, f0dbd9355ce1e93808541260c7ffab7956df9233 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 654aeddbc6e0f6e56531985bb12328ab4230c6c1 or 2d8b30b496bc53e961ba7415fd629fc27813017c or f0dbd9355ce1e93808541260c7ffab7956df9233 or 1e2a44875b6afb4add1115f7f3351dcbeb6f273d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.18.30 or 7.0.7, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux30353bfc43a1602c020f31d95cf27182ffd23824 up to, but not including, 654aeddbc6e0f6e56531985bb12328ab4230c6c1; 30353bfc43a1602c020f31d95cf27182ffd23824 up to, but not including, 2d8b30b496bc53e961ba7415fd629fc27813017c; 30353bfc43a1602c020f31d95cf27182ffd23824 up to, but not including, f0dbd9355ce1e93808541260c7ffab7956df9233; 30353bfc43a1602c020f31d95cf27182ffd23824 up to, but not including, 1e2a44875b6afb4add1115f7f3351dcbeb6f273d; 30353bfc43a1602c020f31d95cf27182ffd23824 up to, but not including, 8b7833f3bce35cb0d01c1503781523c099c675f0; 30353bfc43a1602c020f31d95cf27182ffd23824 up to, but not including, c9341307ea16b9395c2e4c9c94d8499d91fe31d0; 4.9654aeddbc6e0f6e56531985bb12328ab4230c6c1, 2d8b30b496bc53e961ba7415fd629fc27813017c, f0dbd9355ce1e93808541260c7ffab7956df9233, 1e2a44875b6afb4add1115f7f3351dcbeb6f273d, 8b7833f3bce35cb0d01c1503781523c099c675f0, c9341307ea16b9395c2e4c9c94d8499d91fe31d0
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update ServiceNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.6 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 6Not specified in the recordNot stated
LinuxLinux Kernel4.9 up to, but not including, 6.18.30; 6.19 up to, but not including, 7.0.7; 7.16.18.30, 7.0.7

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.0HighCNA

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical section. It also will crash if an event is delivered before the srq object is finished initializing. Use the spinlock since it isn't easy to make RCU work, use refcount_inc_not_zero() to protect against partially initialized objects, and order the refcount_set() to be after the srq is fully initialized.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Race Condition within a Thread

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

How developers prevent this class of flaw

  • Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.
  • Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.

More Race Condition within a Thread vulnerabilities (CWE-366)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Race Condition within a Thread vulnerabilities

Spotted an error? Tell us.