CVE-2026-46117 Overview
CVE-2026-46117 affects the Linux kernel's RDMA driver for the Microsoft Azure Network Adapter (MANA). The flaw resides in mana_ib_create_qp_rss(), where a user can supply Work Queues (WQs) sharing the same Completion Queue (CQ) through the user API. This input triggers a WARN_ON() assertion and subsequently corrupts kernel memory. The upstream fix rejects the invalid configuration outright and fails Queue Pair (QP) creation. The vulnerability falls under kernel input validation and memory corruption issues exposed through the RDMA uAPI surface.
Critical Impact
Local users with access to the MANA RDMA uAPI can corrupt kernel memory by submitting WQs that share a CQ during RSS QP creation.
Affected Products
- Linux kernel — RDMA mana_ib driver (function mana_ib_create_qp_rss())
- Linux stable branches receiving the referenced patch commits
- Systems exposing Microsoft Azure Network Adapter RDMA functionality to unprivileged users
Discovery Timeline
- 2026-05-28 - CVE-2026-46117 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46117
Vulnerability Analysis
The defect lives in the RDMA/mana driver, which implements InfiniBand verbs for the Microsoft Azure Network Adapter. The function mana_ib_create_qp_rss() creates a Receive Side Scaling (RSS) Queue Pair from parameters supplied through the user API. The driver assumed that each Work Queue supplied by the caller would point to a distinct Completion Queue. When userspace violates that assumption by submitting WQs that share a CQ, the driver hits a WARN_ON() assertion. Execution continues past the warning and proceeds to manipulate kernel data structures based on the invalid configuration, corrupting kernel memory.
Root Cause
The root cause is missing input validation across the uAPI boundary. The driver treated an internal invariant (one CQ per WQ) as something callers would always honor, expressing the check only as WARN_ON() rather than a hard failure. WARN_ON() is a non-fatal diagnostic, so the function continued executing after the warning and used the malformed inputs to update kernel state, producing memory corruption [CWE-20, CWE-617].
Attack Vector
A local user with permission to open the MANA RDMA device and issue verbs through the uAPI can trigger the bug. The attacker calls the QP creation path with multiple WQs referencing the same CQ. The kernel logs a warning and then corrupts internal RDMA bookkeeping structures. The fix, applied in commits 159f2ef, 9cc0c6b, 9ef65af, and db991ba, replaces the warning with an outright rejection that fails QP creation when the invariant is violated.
Detection Methods for CVE-2026-46117
Indicators of Compromise
- Kernel log entries containing WARN_ON traces originating from mana_ib_create_qp_rss in drivers/infiniband/hw/mana/.
- Unexpected oopses, panics, or RDMA subsystem instability on hosts exposing the MANA RDMA device to user workloads.
- Repeated failed or malformed ibv_create_qp_ex calls from non-privileged processes targeting the mana_ib device.
Detection Strategies
- Monitor dmesg and journald for warnings emitted from the mana_ib driver and correlate them with the originating process and user.
- Audit which local users and containers have access to /dev/infiniband/ devices on MANA-enabled hosts.
- Track kernel version inventory against the patched commits to identify systems still exposed to the issue.
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on WARN_ON events tied to RDMA modules.
- Baseline normal RDMA QP creation patterns and flag anomalous bursts of QP creation failures.
- Include kernel build hashes and module versions in endpoint inventory data to detect unpatched hosts.
How to Mitigate CVE-2026-46117
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 159f2ef, 9cc0c6b, 9ef65af, and db991ba from the stable tree.
- Update to a distribution kernel that incorporates the fix for mana_ib_create_qp_rss().
- Restrict access to MANA RDMA devices to trusted users and workloads until the patch is deployed.
Patch Information
The fix removes the user-triggerable WARN_ON() and rejects QP creation when WQs share a CQ. Patches are available in the stable kernel tree: Kernel Patch Commit 159f2ef, Kernel Patch Commit 9cc0c6b, Kernel Patch Commit 9ef65af, and Kernel Patch Commit db991ba.
Workarounds
- Unload the mana_ib module on systems that do not require RDMA over the Microsoft Azure Network Adapter.
- Tighten permissions on /dev/infiniband/uverbs* so only trusted service accounts can issue verbs.
- Use container and namespace controls to prevent untrusted workloads from reaching the RDMA uAPI on MANA-enabled hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
