CVE-2026-46126: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana: Fix manadestroywqobj() cleanup in manaibcreateqprss()
Sashiko points out there are two bugs here in the error unwind flow, both related to how the WQ table is unwound.
First there is a double i-- on the first failure path due to the while loop having a i--, remove it.
Second if manaibinstallcqcb() fails then manacreatewqobj() is not undone due to the above i--.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the duplicate i-- decrement in the error-unwind path of mana_destroy_wq_obj() invoked from mana_ib_create_qp_rss(), so the WQ table unwind no longer performs a double decrement.
Linux kernel RDMA/mana duplicate decrement in mana_destroy_wq_obj() error-unwind = remove - Configuration
Ensure that if mana_ib_install_cq_cb() fails, the allocations/changes from mana_create_wq_obj() are undone—perform proper cleanup/unwind of the WQ table (reverse mana_create_wq_obj() effects) to avoid leaving inconsistent state.
Linux kernel RDMA/mana cleanup on mana_ib_install_cq_cb() failure = undo mana_create_wq_obj() / perform proper cleanup