CVE-2026-46117: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana: Remove user triggerable WARNON() in manaibcreateqprss()
Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARNON() then go on to corrupt the kernel.
Just reject it outright and fail the QP creation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with RDMA/mana support are exposed when a user can invoke the relevant RDMA userspace API to create an RSS queue pair. Exploitation requires local access and low privileges.
What input is required to trigger the vulnerability?
The user must request creation of an RSS queue pair using work queues that share the same completion queue. This condition was allowed by the uAPI and could trigger a WARN_ON() followed by kernel corruption.
What is the expected behavior after the fix?
Queue-pair creation is rejected when the supplied work queues share the same completion queue. This prevents the user-controlled WARN_ON() path and subsequent corruption.