CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mana: Validate rxhashkeylen
Sashiko points out that rxhashkeylen comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the memcpy cannot overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Compensating control
Update the affected Linux kernel with the resolution for RDMA/mana: Validate rx_hash_key_len to ensure rx_hash_key_len from the uAPI structure is validated before being passed to memcpy.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who can interact with the RDMA/mana interface can supply a crafted userspace rx_hash_key_len value. The vulnerability is locally exploitable and requires low privileges; no user interaction is required.
What is the impact of successful exploitation?
The unchecked length is passed to memcpy, allowing userspace to overwrite kernel memory. This can affect kernel integrity and availability, with limited confidentiality impact.
Which systems should be prioritized for review?
Prioritize Linux systems using the RDMA/mana driver or interface, including deployments of the listed Microsoft azl3 kernel version. The provided data does not establish whether the driver is enabled or reachable by default.
How can I determine whether a system is affected?
Check whether the running Linux kernel includes the vulnerable RDMA/mana code and whether RDMA/mana is present for local users to access. Also compare your vendor kernel build against the vendor security advisory or errata referenced for this CVE.