CVE-2026-46144: Linux Kernel RDMA/mana Error Handling Flaw

CVE-2026-46144 Overview

CVE-2026-46144 affects the Linux kernel's Microsoft Azure Network Adapter (MANA) RDMA driver. The vulnerability resides in the mana_ib_create_qp_rss() function, where the error unwind path fails to release resources allocated by mana_ib_cfg_vport_steering(). When queue pair (QP) creation fails after vport steering has been configured, the steering configuration is leaked because only the normal destroy path performs cleanup. This issue was identified by a contributor referred to as Sashiko and resolved in upstream Linux kernel commits. The flaw represents a kernel memory leak within the RDMA subsystem rather than a directly exploitable memory corruption issue.

Critical Impact
Repeated failure of RDMA QP creation can cause resource exhaustion in the MANA InfiniBand driver, degrading availability on affected Linux systems using Microsoft Azure Network Adapter hardware.

Affected Products

Linux kernel — RDMA/mana driver (drivers/infiniband/hw/mana)
Systems using Microsoft Azure Network Adapter (MANA) with RDMA
Stable kernel branches referenced in upstream fix commits

Discovery Timeline

2026-05-28 - CVE-2026-46144 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46144

Vulnerability Analysis

The vulnerability is a resource leak [CWE-401] in the Linux kernel's RDMA driver for the Microsoft Azure Network Adapter. The function mana_ib_create_qp_rss() allocates and configures a vport steering entry via mana_ib_cfg_vport_steering() during queue pair creation for receive-side scaling (RSS). If a later step in the QP creation sequence fails, the function jumps to an error unwind label that does not call the corresponding teardown for the steering configuration.

Only the normal destroy_qp path cleans up the steering state. As a result, the steering entry remains configured on the hardware and the associated kernel bookkeeping persists after the failed allocation. Each failed creation leaks driver state until the system is reset or the module is unloaded.

Root Cause

The root cause is an asymmetry between resource acquisition and release in the error handling path of mana_ib_create_qp_rss(). Resource cleanup logic was implemented in the destroy path but not mirrored in the create-time error unwind. This is a common class of kernel bug where partial initialization is not undone on the failure branch.

Attack Vector

Triggering the leak requires the ability to invoke RDMA QP creation operations against the MANA driver and to induce failures in the later stages of QP setup. Local users with access to the RDMA verbs interface on an affected system can repeatedly exercise the failing path. The result is gradual exhaustion of vport steering resources rather than code execution or privilege escalation. No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. Refer to the upstream commits listed in the references for the precise source-level change that adds the missing cleanup call.

Detection Methods for CVE-2026-46144

Indicators of Compromise

Repeated failures returned from RDMA QP creation operations targeting the MANA driver on Azure-hosted Linux instances.
Growth in kernel memory or driver-tracked steering entries that does not correlate with active RDMA workload size.
Kernel log entries from the mana_ib driver indicating QP creation errors over time.

Detection Strategies

Compare installed kernel version against the fixed commits listed in the kernel.org references to identify unpatched hosts.
Monitor dmesg and journald output for RDMA and mana_ib error messages during workload runs.
Track RDMA resource counters exposed via /sys/class/infiniband for unexpected upward drift.

Monitoring Recommendations

Establish baselines for RDMA QP allocation success and failure rates on MANA-enabled hosts.
Alert on sustained QP creation failures, which can indicate either misconfiguration or active triggering of the leak.
Include kernel version inventory checks in regular configuration management audits for Azure Linux fleets.

How to Mitigate CVE-2026-46144

Immediate Actions Required

Identify Linux systems using the MANA RDMA driver, typically Azure virtual machines with accelerated networking and RDMA enabled.
Apply the latest stable kernel update from your distribution that incorporates the upstream fix commits.
Restart affected workloads after patching to clear any leaked driver state from prior runs.

Patch Information

The fix is available in upstream Linux kernel commits referenced on kernel.org, including 190e570c, 30e8a2f3, 6aaa978c, 726af85e, and ab64c63b. The patch adds the missing cleanup call to the error unwind path in mana_ib_create_qp_rss(). Distribution-specific backports should be tracked through vendor security advisories.

Workarounds

Restrict access to RDMA verbs interfaces to trusted local users where feasible.
Avoid configurations that repeatedly retry failing QP creation, and surface persistent RDMA errors to operators promptly.
Where RDMA is not required, disable the mana_ib module to remove exposure entirely.

bash

# Verify whether the mana_ib driver is loaded on the host
lsmod | grep mana_ib

# If RDMA is not used, unload the module to eliminate exposure
sudo modprobe -r mana_ib

# Confirm running kernel version against vendor patch advisories
uname -r