CVE-2026-46145: Linux Kernel Privilege Escalation Flaw

CVE-2026-46145 Overview

CVE-2026-46145 is a Linux kernel vulnerability in the Microsoft Azure Network Adapter (MANA) Remote Direct Memory Access (RDMA) driver. The driver accepts an rx_hash_key_len value from a userspace API (uAPI) structure and passes it directly to memcpy without validating the length. A local user with access to the RDMA interface can supply an oversized length to corrupt kernel memory adjacent to the destination buffer. The fix introduces a bounds check so the memcpy operation cannot overflow.

Critical Impact
Local userspace input drives an unbounded kernel memcpy, producing an out-of-bounds write in the RDMA/mana driver that can corrupt kernel memory.

Affected Products

Linux kernel — RDMA mana driver (drivers/infiniband/hw/mana)
Distributions shipping Linux kernels with the MANA RDMA driver enabled
Azure guest images using the MANA NIC with RDMA functionality

Discovery Timeline

2026-05-28 - CVE-2026-46145 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46145

Vulnerability Analysis

The vulnerability resides in the RDMA/mana driver path that processes Receive Side Scaling (RSS) hash key configuration from userspace. The rx_hash_key_len field is part of a uAPI structure submitted by an unprivileged process holding an RDMA device file descriptor. The driver previously used this caller-controlled length as the size argument to memcpy when copying the hash key into a kernel-side buffer of fixed size.

Because no upper bound was enforced, supplying a length larger than the destination buffer results in a linear heap or stack out-of-bounds write [CWE-787]. Adjacent kernel objects can be overwritten with attacker-supplied bytes, which is a primitive commonly leveraged for privilege escalation through kernel object corruption. The patch series adds a length validation step that rejects values exceeding the maximum supported hash key size before the copy executes.

Root Cause

The root cause is missing input validation on a length field crossing the user-kernel boundary. The driver trusted rx_hash_key_len from the uAPI structure and forwarded it to memcpy without comparing it against the destination buffer capacity, violating standard kernel input-handling practice for uAPI structures.

Attack Vector

Exploitation requires local access to the RDMA mana device interface, typically /dev/infiniband/uverbsN. An attacker constructs a verbs command that sets rx_hash_key_len to a value larger than the fixed-size kernel destination. When the driver invokes memcpy(dest, src, rx_hash_key_len), bytes beyond the destination are overwritten with attacker-supplied content from the user buffer. The vulnerability is described in the upstream commits referenced below; no public exploit is available.

See the upstream fix commits for technical details: Kernel Git Commit 012796f, Kernel Git Commit 11c1431d, Kernel Git Commit 6dd2d4ad, Kernel Git Commit 7d7c9f0f, and Kernel Git Commit 7d94f155.

Detection Methods for CVE-2026-46145

Indicators of Compromise

Kernel oops or panic messages referencing mana_ib, memcpy, or KASAN out-of-bounds write reports in dmesg.
Unexpected crashes of processes interacting with /dev/infiniband/uverbs* on Azure VMs running the MANA driver.
Slab corruption warnings (BUG: KASAN: slab-out-of-bounds) tied to RDMA verbs ioctl paths.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to catch the out-of-bounds write deterministically during fuzzing of RDMA verbs.
Audit kernel logs for crashes correlated with userspace processes issuing ibv_create_qp_ex or RSS configuration calls.
Track installed kernel package versions against distribution security advisories that reference the fix commits.

Monitoring Recommendations

Forward dmesg, journald, and auditd records from Linux hosts to a centralized log platform and alert on kernel oops or KASAN findings.
Monitor process access to /dev/infiniband/uverbs* from unexpected, non-privileged accounts.
Track kernel version drift across the fleet and flag hosts running unpatched kernels with the MANA driver loaded.

How to Mitigate CVE-2026-46145

Immediate Actions Required

Apply the upstream kernel patches identified by commits 012796f9, 11c1431d, 6dd2d4ad, 7d7c9f0f, and 7d94f155 or upgrade to a distribution kernel that includes them.
Inventory Linux hosts where the mana_ib module is loaded, prioritizing Azure VMs with RDMA-capable workloads.
Restrict access to /dev/infiniband/* device nodes to trusted service accounts using filesystem permissions and namespace isolation.

Patch Information

The fix adds a bounds check on rx_hash_key_len before the memcpy call in the RDMA/mana driver. Stable kernel branches receive backports through the five referenced commits. Consult your distribution's security tracker for the specific kernel package version that includes the fix.

Workarounds

Unload the mana_ib kernel module on hosts that do not require RDMA functionality using modprobe -r mana_ib.
Blacklist mana_ib in /etc/modprobe.d/ to prevent automatic load on boot when RDMA is not needed.
Limit container and VM workloads from accessing InfiniBand uverbs devices through seccomp and device cgroup policies.

bash

# Configuration example
# Prevent the vulnerable module from loading when RDMA is not required
echo 'blacklist mana_ib' | sudo tee /etc/modprobe.d/disable-mana-ib.conf
sudo modprobe -r mana_ib 2>/dev/null || true

# Verify kernel version after patching
uname -r