CVE-2026-97613: net: mana: Reserve extra CQ slot for the fence completion CQE
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Reserve extra CQ slot for the fence completion CQE
The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The current sizing reserves no extra slot for it and in rare cases, CQ has no guaranteed slot for the fence CQE when it is full of packet CQEs. This can lead to dropping the fence completion while the driver waits holding RTNL lock throughout the timeout duration. Reserve one extra CQE slot for CQERXOBJECTFENCE. managdallocmemory() requires queuesize to be a power-of-two and at least MANAPAGESIZE; the reservation pushes cqsize past a power-of-two, so round up the CQ size in manacreaterxq().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In mana_create_rxq() and mana_gd_alloc_memory(), size the RX completion queue with one additional slot for the fence completion CQE; if the reservation makes the size exceed a power of two, round it up while keeping queue_size at least MANA_PAGE_SIZE.
Linux kernel MANA driver RX completion queue size = Reserve one extra CQE for CQE_RX_OBJECT_FENCE and round queue_size up to a power of two
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The condition occurs when a MANA receive completion queue is filled with packet completion entries and hardware posts the additional fence completion entry generated by MANA_FENCE_RQ. The fence completion can then be dropped because no queue slot was reserved for it.
What is the operational impact if the fence completion is dropped?
The driver can wait for the missing fence completion until a timeout expires while holding the RTNL lock. This can cause network-related operations requiring that lock to be blocked for the timeout duration.
How can the issue be mitigated?
Apply a Linux kernel update containing the fix that reserves an additional completion-queue entry for the fence completion and rounds the queue size up as required. The provided stable-kernel references identify fixes for this issue.