CVE-2026-46084: RDMA/mana_ib: Disable RX steering on RSS QP destroy
In the Linux kernel, the following vulnerability has been resolved:
RDMA/manaib: Disable RX steering on RSS QP destroy
When an RSS QP is destroyed (e.g. DPDK exit), manaibdestroyqprss() destroys the RX WQ objects but does not disable vPort RX steering in firmware. This leaves stale steering configuration that still points to the destroyed RX objects.
If traffic continues to arrive (e.g. peer VM is still transmitting) and the VF interface is subsequently brought up (manaopen), the firmware may deliver completions using stale CQ IDs from the old RX objects. These CQ IDs can be reused by the ethernet driver for new TX CQs, causing RX completions to land on TX CQs:
WARNING: manapolltxcq+0x1b8/0x220 [mana] (issq == false) WARNING: managdprocesseqevents+0x209/0x290 (cqtable lookup fails)
Fix this by disabling vPort RX steering before destroying RX WQ objects. Note that manafencerqs() cannot be used here because the fence completion is delivered on the CQ, which is polled by user-mode (e.g. DPDK) and not visible to the kernel driver.
Refactor the disable logic into a shared manadisablevportrx() in manaen, exported for use by manaib, replacing the duplicate code. The ethernet driver's manadeallocqueues() is also updated to call this common function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Disable vPort RX steering before destroying RX WQ objects / destroying RSS QP, so stale steering configuration in firmware does not deliver RX completions to old (stale) CQ IDs (fix for "RDMA/mana_ib: Disable RX steering on RSS QP destroy").
RDMA/mana_ib (Linux kernel driver) vPort RX steering on RSS QP destroy = disabled - Configuration
Refactor the vPort RX steering disable logic into a shared mana_disable_vport_rx() helper (used by mana_ib) and update the ethernet driver deallocation path to call this common function, ensuring steering is disabled in all relevant queue destruction scenarios.
mana_ib driver codebase mana_disable_vport_rx() = use shared disable logic
Event History
Frequently Asked Questions
What is CVE-2026-46084?
CVE-2026-46084 is a vulnerability in the Linux kernel related to RDMA/mana_ib that fails to disable RX steering on RSS Queue Pair destruction.
What is the risk level of CVE-2026-46084?
The risk level of CVE-2026-46084 is categorized as a severity score of 37.
How do I fix CVE-2026-46084?
To fix CVE-2026-46084, ensure that you update your Linux kernel to a version that includes the patch for this vulnerability.
What does CVE-2026-46084 affect?
CVE-2026-46084 affects the RDMA/mana_ib driver in the Linux kernel.
When was CVE-2026-46084 published?
CVE-2026-46084 was published on May 27, 2026.