CVE-2026-46126: Linux Kernel Privilege Escalation Flaw

CVE-2026-46126 Overview

CVE-2026-46126 affects the Linux kernel's RDMA/mana driver, specifically in the mana_ib_create_qp_rss() function. The flaw resides in the error unwind path where the Work Queue (WQ) table cleanup is mishandled. Two distinct defects exist in the cleanup logic: a double decrement of the loop index variable i and a missed cleanup of mana_create_wq_obj() when mana_ib_install_cq_cb() fails. The issue was reported by a contributor identified as Sashiko and has been resolved upstream through multiple stable kernel commits.

Critical Impact
Improper resource cleanup in the Microsoft Azure Network Adapter (MANA) InfiniBand driver error path can leave kernel resources in an inconsistent state, potentially leading to memory leaks or use-after-free conditions during failure handling.

Affected Products

Linux kernel — RDMA/mana driver subsystem
Stable kernel branches referenced by commits 34ecf79, 8f23eb6, 9a05a67, and bb9cb36
Systems using Microsoft Azure Network Adapter (MANA) InfiniBand functionality

Discovery Timeline

2026-05-28 - CVE-2026-46126 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46126

Vulnerability Analysis

The vulnerability resides in the RDMA/mana driver's queue pair (QP) creation routine for Receive Side Scaling (RSS). When mana_ib_create_qp_rss() encounters a failure mid-initialization, it must roll back any Work Queue objects already created. The unwind loop performs the rollback incorrectly in two ways.

First, the loop iterator i is decremented twice on the first failure path. The while loop already includes an i-- operation, but an additional decrement causes the unwind to skip a valid WQ object. This results in one allocated WQ object never being destroyed.

Second, when mana_ib_install_cq_cb() fails after mana_create_wq_obj() has succeeded for the current index, the failure path does not call mana_destroy_wq_obj() for that specific object. The faulty index handling means the newly created WQ object is leaked on this error branch.

Root Cause

The root cause is incorrect loop counter arithmetic combined with incomplete error-path coverage in the WQ table unwind logic of mana_ib_create_qp_rss(). The duplicate decrement skips one cleanup iteration, and the missing call to mana_destroy_wq_obj() when completion queue callback installation fails leaves a kernel object dangling.

Attack Vector

No public exploit is available, and no attack vector has been published in the NVD record. The defect manifests only along error paths during RDMA QP RSS setup on systems using the MANA driver. Exploitability requires triggering failure conditions inside the kernel's RDMA initialization sequence, which is generally limited to privileged or local contexts.

Readers should consult the upstream patches for technical details:

Detection Methods for CVE-2026-46126

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-46126.
Kernel logs showing repeated RDMA/mana QP creation failures may indicate exposure to the error path containing the defect.

Detection Strategies

Inventory kernel versions across Linux fleets and identify hosts running the RDMA/mana driver, particularly Azure-hosted Linux instances using MANA.
Compare installed kernel build identifiers against the fixed commits 34ecf79, 8f23eb6, 9a05a67, and bb9cb36 to confirm patch status.
Monitor dmesg and kernel ring buffer output for mana_ib_create_qp_rss failure messages that exercise the affected unwind path.

Monitoring Recommendations

Collect kernel telemetry centrally and alert on RDMA driver errors involving MANA components.
Track memory utilization on long-running RDMA workloads to detect leaks consistent with the unfreed WQ object.
Audit kernel package update status across hosts that handle accelerated network workloads.

How to Mitigate CVE-2026-46126

Immediate Actions Required

Update affected Linux kernels to a version containing the upstream fix commits referenced in the NVD record.
Identify all systems running the MANA RDMA driver and prioritize patching for hosts handling accelerated networking workloads.
Validate that distribution vendors have backported the fix to supported long-term-support kernel branches in use.

Patch Information

The fix is committed upstream in the Linux kernel stable tree. Four commits address the defect: 34ecf795692ee57c393109f4a24ccc313091e137, 8f23eb6c50f1a4bf32fc4d62cfb9fc39e8e586cf, 9a05a6798177e44dfbe18393be2c1ebb89ab06fd, and bb9cb36eaefa4dcb7c0d9f7a01e5c739abdd53a8. The patches remove the duplicate i-- in the unwind loop and ensure mana_destroy_wq_obj() is invoked when mana_ib_install_cq_cb() fails. Administrators should obtain updated kernel packages from their Linux distribution vendor.

Workarounds

If patching is not immediately possible, avoid configurations that exercise RDMA QP RSS creation on the MANA driver.
Restrict access to privileged operations capable of triggering RDMA initialization failures on unpatched hosts.
Reboot affected hosts into a patched kernel as soon as updated packages are validated in change-control processes.

bash

# Verify running kernel version and check against fixed commits
uname -r

# Confirm whether the MANA driver is loaded
lsmod | grep mana

# Apply distribution kernel update (example for Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f2-)
sudo reboot