CVE-2026-46126: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana: Fix manadestroywqobj() cleanup in manaibcreateqprss()
Sashiko points out there are two bugs here in the error unwind flow, both related to how the WQ table is unwound.
First there is a double i-- on the first failure path due to the while loop having a i--, remove it.
Second if manaibinstallcqcb() fails then manacreatewqobj() is not undone due to the above i--.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the duplicate i-- decrement in the error-unwind path of mana_destroy_wq_obj() invoked from mana_ib_create_qp_rss(), so the WQ table unwind no longer performs a double decrement.
Linux kernel RDMA/mana duplicate decrement in mana_destroy_wq_obj() error-unwind = remove - Configuration
Ensure that if mana_ib_install_cq_cb() fails, the allocations/changes from mana_create_wq_obj() are undone—perform proper cleanup/unwind of the WQ table (reverse mana_create_wq_obj() effects) to avoid leaving inconsistent state.
Linux kernel RDMA/mana cleanup on mana_ib_install_cq_cb() failure = undo mana_create_wq_obj() / perform proper cleanup
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required, and the attack complexity is rated low.
What is the expected security impact?
The reported impact is high availability impact. Confidentiality and integrity impacts are rated as none.
Are affected or fixed Linux kernel versions identified?
No affected or fixed version numbers are provided. Three stable kernel commit references are supplied for the resolved issue.