CVE-2026-46117

Technical summary

CVE-2026-46117 is a local privilege escalation vulnerability in the Linux kernel's RDMA/mana (Microsoft Azure Network Adapter) driver affecting the mana_ib_create_qp_rss() function. The vulnerability stems from insufficient input validation when users specify work queue (WQ) configurations via the user-space API. Specifically, when a user requests multiple WQs to share the same completion queue (CQ), the kernel fails to validate this invalid configuration. Instead of rejecting the request early, the code proceeds to a WARN_ON() statement that can be triggered by an unprivileged user, followed by kernel memory corruption. The resolution adds explicit validation to reject such configurations before the invalid state propagates, preventing both the WARN_ON() and subsequent memory corruption.

Business impact

This vulnerability poses a significant internal security risk for organizations running affected Linux kernel versions on systems where untrusted local users have access. Exploitation allows privilege escalation from an unprivileged user context to kernel-level compromise, enabling adversaries to read sensitive kernel memory, modify critical system data, or trigger denial of service. For cloud providers and multi-tenant environments using RDMA-capable hardware, this creates cross-tenant risk if workloads from different customers share physical infrastructure. Systems in research, HPC, or data center environments where RDMA is deployed should treat this as a high-priority concern.

Affected systems

The vulnerability affects Linux kernel versions with the RDMA/mana driver. The mana_ib_create_qp_rss() function is invoked during queue pair creation in RDMA operations, so systems must have RDMA capability enabled and the mana driver compiled in or loaded as a module. This is primarily relevant on Azure infrastructure or systems with Microsoft Azure Network Adapter hardware. Standard Linux distributions on non-Azure infrastructure are unaffected unless they explicitly enable RDMA/mana support. Verify your kernel configuration and hardware to determine exposure.

Exploitability

The vulnerability is highly exploitable by local attackers with user-level privileges (PR:L per CVSS vector). No user interaction or special conditions are required beyond the ability to invoke the affected code path through the RDMA user-space API. The exploit is straightforward: craft a queue pair creation request specifying multiple WQs with a shared CQ, which an unprivileged user can do. The kernel will process the invalid configuration, trigger the WARN_ON(), and corrupt memory. No specialized tools or out-of-band access are required, making this a practical local privilege escalation vector for any user on an affected system.

Remediation

Apply kernel patches that add input validation to reject queue pair creation requests when multiple work queues attempt to share the same completion queue. This fix is delivered in updated kernel releases that contain the corrected mana_ib_create_qp_rss() function. Organizations should prioritize patching systems running affected kernel versions, particularly those in multi-tenant environments or where untrusted local user access exists. Additionally, restrict RDMA access to trusted users where possible, and disable RDMA/mana support on systems where it is not required.

Patch guidance

Update to a kernel version that includes the fix for mana_ib_create_qp_rss() validation. Consult your Linux distribution's security advisory for specific patched kernel versions and deployment timelines. For distributions on Azure infrastructure, verify the release notes and apply updates through your standard kernel update mechanism. Patch testing should verify that legitimate RDMA queue pair creation still functions correctly while invalid configurations are now rejected with an appropriate error message.

Detection guidance

Monitor kernel logs for rejected queue pair creation attempts with error codes indicating CQ validation failures in RDMA operations. Systems with audit logging enabled should capture user-space RDMA API calls that trigger validation rejections. Look for any instances of the mana_ib_create_qp_rss() function being called with suspicious parameters. On systems still running unpatched kernels, detection of the WARN_ON() in kernel logs is a reliable indicator that the vulnerability was triggered. Endpoint Detection and Response (EDR) solutions monitoring privilege escalation attempts may flag related activity if the exploitation reaches kernel state manipulation.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of local privilege escalation capability, straightforward exploitability, and high impact severity. The CVSS score of 7.8 reflects the ability of an unprivileged attacker to achieve complete kernel compromise. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities catalog, but the straightforward nature of exploitation makes public proof-of-concept development likely once awareness increases. Organizations should treat this as urgent for systems in sensitive environments or multi-tenant configurations.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is assigned due to: Local Attack Vector (AV:L) reflecting the requirement for local access; Low Attack Complexity (AC:L) indicating no special conditions beyond standard API access; Low Privileges Required (PR:L) showing unprivileged user sufficiency; No User Interaction (UI:N); and Unchanged Scope (S:U). The impact ratings of High for Confidentiality, Integrity, and Availability reflect the potential for complete kernel compromise, enabling memory disclosure, data modification, and system crashes. This score appropriately captures the severity for local privilege escalation vectors with kernel-level compromise potential.

Frequently asked questions