CVE-2026-46126

Technical summary

The vulnerability resides in mana_ib_create_qp_rss() within the RDMA mana driver. During error handling in the work queue table unwinding logic, two distinct bugs corrupt resource cleanup: (1) a redundant decrement operation (i--) appears both in the while loop condition and at the failure point, causing iterator underflow and skipping cleanup iterations, and (2) when mana_ib_install_cq_cb() fails, the preceding mana_create_wq_obj() allocation is never undone because the corrupted iterator causes the cleanup loop to exit prematurely. This leads to unreleased queue objects remaining in kernel memory.

Business impact

Denial of service is the primary risk. Repeated exploitation of this bug allows local attackers to leak kernel resources until system stability degrades or crashes, disrupting services relying on RDMA networking, particularly high-performance computing clusters, storage arrays, and cloud infrastructure using RDMA for low-latency communication. Recovery requires system restart. In multi-tenant environments, a single user can degrade performance for all workloads on the host.

Affected systems

Linux kernel systems with the RDMA mana driver compiled or loaded. This includes kernels built with CONFIG_INFINIBAND_MANA enabled. Primarily affects Azure cloud infrastructure and systems using Mana-based RDMA hardware, though the driver may be present on generic Linux distributions. Systems without RDMA hardware or with the mana driver disabled are not vulnerable.

Exploitability

Exploitability is straightforward for local attackers with unprivileged user access. No special capabilities or kernel modules are required beyond the ability to invoke the vulnerable code path through RDMA queue pair creation APIs. The attack is deterministic and repeatable. Remote exploitation is not possible; the attacker must have local user-level access to the affected system.

Remediation

Apply a kernel update containing the fix that corrects both the iterator double-decrement and ensures mana_create_wq_obj() cleanup occurs regardless of subsequent failure points. Verify against your Linux distribution's security advisory for the specific patched kernel version. For systems unable to patch immediately, restrict RDMA queue pair creation to trusted users via access controls if the mana driver is not essential.

Patch guidance

Monitor your Linux distribution's kernel update channels for a patched version addressing CVE-2026-46126. The fix involves correcting the work queue table unwinding logic in mana_ib_create_qp_rss(). Verify the patch notes explicitly mention removal of the redundant i-- and proper cleanup of mana_create_wq_obj() on all failure paths. Test patches in a non-production environment before deployment, particularly for RDMA-dependent workloads. If using Azure or Mana-specific distributions, prioritize their security advisories.

Detection guidance

Monitor kernel logs for repeated RDMA queue pair creation failures or resource exhaustion warnings specific to mana driver allocations. Watch for kmemleak reports indicating unreleased mana queue objects if CONFIG_DEBUG_KMEMLEAK is enabled. Network monitoring may reveal sudden drops in RDMA throughput or connection failures as kernel memory fills. On systems under attack, vmstat will show increasing memory usage with no corresponding application allocation. Enable audit logging for RDMA subsystem calls if available in your kernel configuration.

Why prioritize this

CVSS 5.5 (Medium) reflects local-only access requirement and lack of confidentiality or integrity impact. However, prioritize patching RDMA-intensive infrastructure—HPC clusters, cloud provider host kernels, and storage array controllers—as denial of service in these environments has outsized business impact. General-purpose systems with RDMA driver disabled can defer patching to routine maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 assigns Medium severity because: Attack Vector is Local (unprivileged user access required, not remote), Privileges Required are Low (standard user level), User Interaction is None (automatic on API call), and Impact is Availability only (resource exhaustion/crash, no data breach). The score appropriately reflects a classic local denial-of-service bug. Organizations relying on RDMA should weight this higher operationally despite the Medium base score.

Frequently asked questions