CVE-2026-46117: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana: Remove user triggerable WARNON() in manaibcreateqprss()
Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARNON() then go on to corrupt the kernel.
Just reject it outright and fail the QP creation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
Reject QP creation when user-specified work queues share the same completion queue, rather than triggering WARN_ON().
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with RDMA/mana support are exposed when a user can invoke the relevant RDMA userspace API to create an RSS queue pair. Exploitation requires local access and low privileges.
What input is required to trigger the vulnerability?
The user must request creation of an RSS queue pair using work queues that share the same completion queue. This condition was allowed by the uAPI and could trigger a WARN_ON() followed by kernel corruption.
What is the expected behavior after the fix?
Queue-pair creation is rejected when the supplied work queues share the same completion queue. This prevents the user-controlled WARN_ON() path and subsequent corruption.